Dictionary · Cybersecurity Fundamentals
Risk
Risk · Beginner
The potential for loss, combining how likely an event is with how severe the impact would be. It is what remains after you consider threats, weaknesses, and controls.
Two weaknesses are not equally urgent. This concept forces the question of what the organization actually stands to lose and how plausible that loss is.
Example: A flaw on an isolated lab PC may be low risk, while the same flaw on a public checkout server may be unacceptable.
Common misconception
- A severe weakness in a system nobody can reach may be lower risk than a milder flaw in a critical public service.