Risk

Updated 05 Sep 2026

•
What it is
- •
  a threat measured by its impact and the probability that it will occur
- •
  The likelihood that a particular threat against a particular asset will actually occur — distinct from the threat itself, and closely tied to an adversary's capability.
•
Why it matters
- •
  Risk assessment is what turns an abstract, endless list of "things that could go wrong" into a manageable, personal plan. It's also subjective: some people find a threat unacceptable no matter how unlikely (because its mere existence is intolerable), while others ignore a genuinely high-likelihood threat because it doesn't feel like a problem to them. Neither is objectively wrong — threat modeling is a personal exercise.
•
Example
- •
  Your phone carrier has the capability to access all your data, but the risk they'd leak it to damage your reputation is low — capability and risk aren't the same thing.
•
Distinguish from
- •
  a Vulnerability is the underlying weakness; a Threat is that weakness being acted upon; risk adds a measure of likelihood and impact on top of a threat
•
Related
- •
  Vulnerability
- •
  Threat
- •
  Gap Analysis
- •
  Threat Modeling
- •
  Adversary

Linked references 12