Using the working definition from this lesson, which statement best describes risk?
Choose an answer, then check it.
Cybersecurity · Foundations
Risk
On this page 9 sections
In 30 seconds
risk The combination of how likely a harmful event is and how severe the harm would be if it happened; the working definition used across the security field is framed by NIST. Full entry → is how likely a bad event is, combined with how bad it would be — the working definition used across the security field, framed by NIST. Risk forms where three things meet: a threat Anything that could cause harm, such as a person with bad intentions, a careless mistake, or a natural event; one corner of the risk triangle. Full entry →, a vulnerability A weakness that harm could slip through, such as an unlocked door or an unpatched system; one corner of the risk triangle. Full entry →, and something of value. A risk assessment The process of identifying, estimating, and prioritizing risks so decision makers know what deserves attention first. Full entry → asks what matters, what could hurt it, how likely, and how bad. Once risks are ranked, organizations respond by reducing, transferring, avoiding, or accepting them, guided by how much risk they are willing to take.
Why this matters
Every security budget, deadline, and debate is really a conversation about risk, so the concept is the closest thing the field has to a shared language. Understanding it lets you ask the questions that matter — what could go wrong, how likely, how bad — instead of reacting to every alarm. In coursework, risk links the foundations (threats, vulnerabilities, the CIA triad) to later topics such as the NIST Cybersecurity Framework and incident response. In work and daily life, it is the difference between vague worry and a reasoned priority list: knowing which problems deserve action, which can be insured, which should be avoided, and which are acceptable to live with.
The college version
What risk is: likelihood and impact together
Risk is the idea at the center of every security decision. When a team chooses what to protect first, where to spend money, or which problems it can live with, it is thinking about risk. The working definition comes from NIST, the U.S. agency that publishes foundational cybersecurity guidance: risk is a measure of the extent to which something is threatened, typically a function of the adverse impact The harm an event would cause if it happened, to operations, assets, people, or reputation; the other half of risk. Full entry → that would arise if a harmful event occurred and the likelihood How probable it is that a harmful event will occur, one of the two halves of risk. Full entry → of that event occurring. In plain words, risk is how likely a bad thing is, combined with how bad it would be. Both halves pull their weight. An event that is very likely but harmless is a small risk; an event that is devastating but nearly impossible is also a small risk. The big risks are the ones where both sides are high. That is what the classic shorthand, risk equals likelihood times impact, is really saying — not a formula to compute, but a reminder to ask both questions every time.
The risk triangle: threats, vulnerabilities, and value
Risk does not appear on its own; it forms where three ingredients meet, and security writing often draws them as a triangle. The first corner is a threat — anything that could cause harm, such as a person with bad intentions, a careless mistake, or a natural event. The second is a vulnerability — a weakness that harm could slip through, such as an unlocked door or an unpatched system. The third is the value at stake — the thing worth protecting, such as customer records, a reputation, or a service people depend on. Remove any corner and the risk changes. An unlocked door is only a problem if someone might walk through it and only if the room holds something worth taking. Threats and vulnerabilities have their own lessons in this course; here they are ingredients, not the main dish. Risk is what forms when all three come together, and NIST's risk guidance treats exactly these factors — threats, vulnerabilities, impact, and likelihood — as the raw material of any assessment.
Risk assessment: finding out what the risks are
A risk assessment is the process of finding out what the risks actually are. NIST defines it as identifying, estimating, and prioritizing risks, and describes the purpose plainly: risk assessments inform decision makers and support the responses chosen afterward. In everyday terms, an assessment asks four questions. What do we have that matters? What could hurt it? How likely is that? How bad would it be? The answers are ranked, so the serious problems rise to the top and the small ones stop consuming attention. The assessment itself fixes nothing; it produces the list that makes fixing possible. NIST also cautions that systems, threats, and environments change over time, so the usefulness of any assessment is bounded in time — it is a snapshot, not a permanent verdict. A clinic that assessed its risks last year should look again this year.
Treating risk: reduce, transfer, avoid, accept
Once a risk is known, the organization chooses a response, and NIST's enterprise risk management guidance names four classic actions. Reduce — sometimes called mitigate — means lowering the likelihood or the impact, for example by patching a weakness or adding a control. Transfer means shifting part of the consequence to another party, typically by buying insurance or relying on a vendor that accepts the liability. Avoid means stopping the activity that carries the risk, such as taking a service offline or refusing to store certain data. Accept means deciding that the risk falls within what the organization can tolerate and continuing, with monitoring. Each of the four is a legitimate choice; the right one depends on cost, mission, and how much risk the organization is willing to carry.
Risk appetite: how much risk an organization will live with
Organizations differ in how much risk they accept, and the difference is normal. NIST defines risk appetite The amount of risk an organization is willing to accept while pursuing its mission, set by its leadership. Full entry → as the broad-based amount of risk an organization is willing to accept in pursuit of its mission. A hospital and a startup can face the same technical weakness and respond differently: the hospital may refuse any risk to patient data, while the startup may accept a moderate risk to keep moving quickly. NIST adds a caution: an organization that tries to avoid all cybersecurity risk may stifle the very work it exists to do. Risk appetite is set by leadership, guides which response fits, and can change as circumstances change.
Why risk thinking matters
The payoff is practical. Risk thinking turns diffuse fear into a ranked list, and a ranked list is what makes priorities possible. OWASP, the application-security community, makes the point directly: a system for rating risks saves time and eliminates arguing about priorities, so an organization is not distracted by minor risks while more serious ones go unaddressed. Instead of "everything is dangerous," risk thinking produces "these three things need attention first, and here is why." That is the difference between worrying and deciding — and it is why risk, more than any single attack or weakness, is the concept that makes security decisions coherent.
Eli explains
The same idea, in plain words
Explain it like I’m 10
Risk is how likely a bad thing is, combined with how bad it would be. It is not the same as danger in general. Danger feels like everything at once; risk is two specific questions you can actually answer. Risk forms when three things come together: something that could cause harm, a weakness it can get through, and something you care about that is in the way. Take away any one of the three and the risk shrinks or vanishes. Once you know a risk, you choose what to do: make it smaller, move some of the cost to someone else, stop the activity entirely, or decide you can live with it. Organizations differ on the last one — some accept risks others would never touch.
Picture it like this
Think of risk as crossing a busy street. The likelihood is how much traffic is coming; the impact is what happens if a car hits you. A quiet side street and a six-lane highway are different problems, and you treat them differently: you cross the side street carefully, take the pedestrian bridge over the highway, or decide the highway is not worth crossing at all. The street is the same for everyone; whether you cross, wait, or walk to the bridge depends on how much risk you are willing to take.
Where the picture stops working
The analogy has limits. Crossing a street is a decision you make in seconds, while organizational risk decisions involve many people, long time horizons, and costs that are hard to compare. A street has clear traffic you can see; a business rarely knows exactly how likely an attack is or what the damage would add up to. And unlike a street, which you can simply avoid, an organization often cannot stop doing its core work without failing its mission — so accepting some risk is usually unavoidable.
Worked example
Maple & Pine, a small dental clinic, keeps patient records in an online booking system and a backup drive in a desk drawer. The manager lists what matters: patient records, appointment availability, and the clinic's reputation. Then, what could hurt it: a ransomware infection encrypting the booking system, an unencrypted backup drive sitting in a shared office, and the value of the records themselves. Likelihood is medium, because staff have clicked on suspicious email attachments before; impact is high, because the records are regulated and irreplaceable. Risk: high. The response plan uses all four options. Reduce: automatic encrypted backups and email filtering. Transfer: cyber insurance for the recovery costs. Avoid: stop keeping a second unencrypted copy of records anywhere. Accept: the small residual risk of the physical office, with monitoring. Every response is deliberate, and none claims to make risk zero.
Key takeaway
Risk is how likely a bad event is, combined with how bad it would be, and it forms where a threat meets a vulnerability and something of value. Risk thinking turns fear into priorities: assess the risks, respond with reduce, transfer, avoid, or accept, and let risk appetite guide the choice.
Quick check
3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.
The classic shorthand "risk equals likelihood times impact" is best understood as:
Choose an answer, then check it.
A neighborhood clinic stores patient files in a locked cabinet, but staff sometimes leave the front door unlocked during the day. Using the risk triangle, what makes this a risk worth addressing?
Choose an answer, then check it.
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related
You’ll learn to
- Define risk as the combination of how likely a harmful event is and how severe its impact would be, using the NIST-framed working definition.
- Explain the likelihood-times-impact shorthand at an intuitive level, without treating it as a calculation.
- Identify the three ingredients of the risk triangle — a threat, a vulnerability, and something of value at stake — in a given scenario.
- Describe the general risk assessment process: identify what matters, what could hurt it, how likely that is, and how bad it would be.
- Distinguish the four classic risk responses: reduce, transfer, avoid, and accept.
- Apply the concept of risk appetite to explain why different organizations respond differently to the same risk.
Common mistakes
Treating "risk equals likelihood times impact" as a calculation to compute.
It is a way of thinking, not an equation. Real assessments rate likelihood and impact in rough categories and combine them by judgment; the shorthand just keeps both questions in view.
Using "risk" and "threat" as if they were the same word.
A threat is one ingredient — something that could cause harm. Risk is the combination of likelihood and impact that forms when a threat meets a vulnerability and something valuable.
Assuming the goal is zero risk.
Accepting some risk is normal and often necessary; organizations that try to eliminate all risk can stifle the work they exist to do. The goal is to know the risk and respond deliberately.
Believing a risk assessment is a one-time event.
Assessments age as systems, threats, and environments change; NIST notes their usefulness is bounded in time. Reassess, especially after changes.
Thinking "accept" means ignoring the problem.
Acceptance is a deliberate decision that a risk is within tolerance, made with monitoring in place. Ignoring a risk is accidental; accepting it is a choice.
Easily confused
Risk vs. Threat
A threat is one corner of the triangle — something that could cause harm. Risk is the combination of likelihood and impact that forms when a threat meets a vulnerability and something of value.
Reduce vs. Transfer
Reducing lowers the likelihood or the impact directly, by patching or adding controls. Transferring moves part of the financial consequence to another party, such as an insurer, without changing the underlying weakness.
Risk assessment vs. Risk response
Assessment identifies, estimates, and prioritizes risks; response is the action chosen afterward, using reduce, transfer, avoid, or accept. The assessment produces the list; the response works through it.
Key vocabulary
- risk
- The combination of how likely a harmful event is and how severe the harm would be if it happened; the working definition used across the security field is framed by NIST.
- likelihood
- How probable it is that a harmful event will occur, one of the two halves of risk.
- impact
- The harm an event would cause if it happened, to operations, assets, people, or reputation; the other half of risk.
- risk triangle
- A shorthand for the three ingredients that must come together for risk to exist: a threat, a vulnerability, and something of value at stake.
- threat
- Anything that could cause harm, such as a person with bad intentions, a careless mistake, or a natural event; one corner of the risk triangle.
- vulnerability
- A weakness that harm could slip through, such as an unlocked door or an unpatched system; one corner of the risk triangle.
- risk assessment
- The process of identifying, estimating, and prioritizing risks so decision makers know what deserves attention first.
- risk response
- The chosen action for a known risk; the four classic responses are reduce, transfer, avoid, and accept.
- risk appetite
- The amount of risk an organization is willing to accept while pursuing its mission, set by its leadership.
- residual risk
- The risk that remains after a response has been applied; organizations monitor it to keep it within the level they tolerate.
Sources & references
- SP 800-30 Rev. 1, Guide for Conducting Risk Assessments — National Institute of Standards and Technology (NIST)
- NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) — National Institute of Standards and Technology (NIST)
- OWASP Risk Rating Methodology — OWASP Foundation
EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.
Researched 2026-08-21
Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.