Ok, I'm not a security expert, but I do have experience flying a Cessna 152 -- and I stayed at a Holiday Inn Express.

As far as threat assessment:
When the aircraft was first picked up on Radar nearing or entering the DC ADIZ (Air Defense Identification Zone) they should have the ability to pick up the speed of the aircraft and how fast it is moving.
A GA aircraft, such as a Cessna 152 would be moving slowly and would be at a lower altitude. A large jet aircraft, say a commercial airliner, would be moving significantly faster, likely at a higher altitude. If fast moving at a lower altitude, then you know something really isn't right.
I'm going to assume the transponder was likely on and picked up by ATC, but not sqwaking the discrete transponder code which should have been obtained prior to entering the DC ADIZ.
From a risk standpoint, one can make an educated guess this aircraft is likely a small, slow moving, general aviation aircraft. Knowing this the authorities should be able to determine any potential threat is low (vs a fast moving aircraft with no transponder on such as what happened on 9/11).
As it is moving slow, there was time to scamble jets. Once the jets ID & intercept the aircraft, it could be relayed it is indeed low risk. Also note that on average, three aircraft per day violate the DC ADIZ by mistake. In this case, this is just what happened, but this was a more serious violation by entering the FRZ (Flight Restricted Zone).
Aside from it being a pilot lost, not in communication with appropriate ATC nor sqwaking the discrete transponder code, which was the case, the few potential worst case scenario's: (1) suicidal pilot wanting to fly into building: result, minimal damage or (2) aircraft has explosives on-board with intention to fly into building: potential significant damage, loss of lives.
The second scenario cannot be ruled out, but from a risk management standpoint based on the fact there are three DC ADIZ violations a day on average, the most likely scenario is a lost pilot.
In this thread, it's been mentioned it could have been a small plane wanting to drop a "chemical" or "bio" weapon. If this was the case, the absolute worst thing to do would be to have people running into the streets.
Secondly, firing at an aircraft to down it, especially a Cessna 152 which is of low risk could potentially result in more damage in the end depending on where the debris lands.
In conclusion, what happened on the ground was a gross over-reaction, IMHO, and made us look like fools worldwide. The North Koreans were probably laughing at this. In the case of the Kentucky Govonor's plane, setting aside the miscommunications, this would have been a much higher threat (faster moving, no transponder).
The way things were handled in the air was 100% appropriate. While I am not an expert, the above is my view based on what I know about what happened. I'm sure those with ATC/DHS/FAA/NORAD overseeing the DC ADIZ know more about what specifically happened. It sounds like all the agencies were in contact and all in communications yesterday and did a good job from the air side of things -- but on the ground side, I believe there was a gross overreaction.
In closing, while the CFI who is technically the PIC and the student pilot were not charged of any crime, I sincerely hope the FAA speaks with the student about the seriousness of what happened and
the CFI gets reamed by the FAA - pull his license & fine him.
With Regards,
SDF_Traveler