Overview
Security is not about eliminating all danger — that is impossible — but about managing risk to an acceptable level. Risk management is the disciplined process of identifying, assessing, and deciding what to do about risks. This lesson establishes the core vocabulary that the rest of the module builds on.
Learning objectives
- Define risk in security terms.
- Break risk into its components.
- Explain why security is fundamentally about risk, not perfection.
Core concept
In security, risk is commonly expressed as a relationship:
Risk ≈ Likelihood × Impact
That is, the chance a harmful event occurs, combined with how bad it would be if it did. Both parts depend on the pieces you met earlier: a threat acting on a vulnerability affecting an asset.
- No asset of value → little risk.
- No plausible threat, or no exploitable vulnerability → lower likelihood.
- Trivial consequences → lower impact.
Risk is therefore always relative to a specific asset and context — the same vulnerability carries different risk in different organizations.
How it works
Formal frameworks (NIST SP 800-30, ISO 27005) describe a risk management process: establish context → identify risks → analyze them (likelihood and impact) → evaluate and prioritize → treat them → monitor and review. It is a cycle, not a one-time project, because assets, threats, and vulnerabilities all change.
The goal is to bring risk within the organization's risk appetite — the amount of risk it is willing to accept in pursuit of its objectives.
Practical example
A company stores customer emails (asset). Phishing crews are a realistic threat; a lack of MFA is a vulnerability; the impact of account takeover is high. Combining these gives a high risk that justifies investment (MFA). The same company's public marketing brochures also face threats, but their loss barely matters — low risk, little investment. Risk framing sends money where it counts.
Cybersecurity relevance
Every security decision — which controls to buy, which vulnerabilities to fix first, how much to spend — is ultimately a risk decision. Framing work as risk management is how security teams justify budgets and set priorities to non-technical leadership.
Common mistakes
- Chasing "zero risk," which is unattainable and wastes resources.
- Treating all risks equally instead of ranking by likelihood and impact.
- Assessing risk once and never revisiting it as conditions change.
Key takeaways
- Risk combines the likelihood of a harmful event with its impact.
- Security manages risk down to an acceptable level rather than eliminating it.
- Risk management is a continuous cycle tied to the organization's risk appetite.
Check your understanding
- Why is "make us completely secure" an unrealistic goal, expressed in risk terms?
- Name the two factors that multiply to estimate a risk, and give an example of each.