What Is Risk in Security?
Security risk is the chance that a threat exploits a vulnerability, multiplied by the damage done if it succeeds. It is what turns a long list of possible problems into a short list of things worth spending money on. Risk is why security is an economics problem, not a checklist: you cannot fix everything, so you rank by risk and work top-down.
What is the risk equation?#
The working shorthand is:
Risk = Likelihood × Impact
Likelihood combines how motivated and capable a threat is with how exposed the vulnerability is. Impact is what it costs you if the event happens — money, data, downtime, trust. A weakness that is trivial to exploit but harms nothing is low risk; a catastrophic-impact flaw that no realistic attacker can reach is also low risk. Only when both factors are high does something demand urgent attention.
This is why a threat model and a CVSS score are inputs to risk, not substitutes for it — they estimate likelihood and impact, which you then combine for your context.
How do you decide what to do about a risk?#
Every identified risk gets one of four treatments:
| Treatment | Meaning | Example |
|---|---|---|
| Mitigate | Add controls to lower likelihood or impact | Patch, add MFA, encrypt |
| Transfer | Shift the loss to someone else | Cyber insurance, outsourcing |
| Avoid | Stop the risky activity entirely | Retire a legacy feature |
| Accept | Consciously live with it | Low-impact bug, documented |
The one unacceptable option is ignore — a risk that is neither treated nor explicitly accepted is just an incident waiting to be a surprise.
Risk is the lens that prioritizes everything else — which attack surface to shrink first, where defense in depth is worth the cost. More at the Security Fundamentals hub.
Frequently asked questions#
What is the difference between a threat, a vulnerability, and a risk?
A threat is something that could cause harm; a vulnerability is a weakness it could exploit; risk is the combination — the likelihood that the threat meets the vulnerability, times the impact if it does. A vulnerability with no threat, or a threat with no matching weakness, carries little risk on its own.
What are the four ways to treat a risk?
Mitigate (reduce likelihood or impact with controls), transfer (shift it to another party, e.g. insurance), avoid (stop doing the risky activity), or accept (acknowledge and live with it). Every identified risk should end with an explicit, recorded decision among these four — not silence.