Consider some human action, C. It could be to commit a crime like launching a cyber-attack or embezzling funds.
How likely is it that there is an actor that intends to attempt C in the next year? Call it P(A)
If an attempt is made how likely is it that the attempt will succeed? Call it P(S).
Assume that a credible source provides estimates for P(S) and P(A). If P(A) and P(S) are both high, it seems reasonable to assume that an estimate of the (let’s call it) “threat potency” is high, and conversely. For C to occur, some actor must both Attempt and Succeed, but is it reasonable to assert that P(A∩S) = P(A) * P(S)? It doesn’t seem so, since in my limited understanding, A and S are not independent. That is, the number of attempts made will be influenced by the perception of success. Am I correct?
And more generally, what is the best way to use those probabilities to characterize the threat potential?
As soon as you say "If an attempt is made", you are talking about a conditional probability. If $S$ is the event of a successful attack, then $P(S)$ is the probability of an attack absent of any other information, whereas $P(S | A)$ is the probability of a successful attack given that event $A$ occurs, i.e. the attack is attempted.
We can also talk about the joint probability, that is the probability that an attack is attempted and succeeds, which is $P(S \cap A)$, and the definition of conditional probability is such that $P(S \cap A) = P(S | A)P(A)$, i.e. it's the product of the probability an attack is made, and the probability that the attack succeeds if it is attempted.
There's also the total probability $P(S)$, and the Law of Total Probability says we can break it up as follows (with $^c$ representing the complementary event, i.e. $A^c$ is the event that an attack is not attempted):
$$\begin{eqnarray} P(S) & = & P(S \cap A) + P(S \cap A^c) \\ & = & P(S | A) P(A) + P(S | A^c) P(A^c) \\ & = & P(S | A) P(A) \end{eqnarray}$$
where in the last line, we are assuming that $P(S | A^c) = 0$, i.e. if the attack is not attempted it can't spontaneously succeed anyway.
As you can see, it will generally not be true that $P(S \cap A) = P(S) P(A)$, but rather since an attempt is required for success to happen we instead have $P(S \cap A) = P(S)$.