The "legitimate threat" clause is intentionally openended so that a DM can determine which situations are appropriate or not. I could include a CR-quantifier, but if, say, a Disciple was getting mobbed by two or three dozen low-level mooks? Would those not be a legitimate threat, even if -5 CR each?