When evaluating a potential threat in an ambiguous environment, which approach best reflects sound risk assessment?