Risk
cyber risk · information security risk · risk assessment · risk management · risque
The possibility that a threat exploits a vulnerability and causes harm, estimated by combining the likelihood of the event with the severity of its impact.
In practice
Risk is the language boards understand: it turns technical issues into business consequences (downtime, financial loss, penalties, reputational damage). It can never be removed entirely: you reduce it with security measures, transfer it (insurance, contracts), avoid it by dropping an activity, or accept it knowingly. In France, ANSSI’s EBIOS Risk Manager method structures this analysis into five workshops that bring business and technical teams together.
Fictional case: an online shop estimates that a day of downtime during the sales would cost it €80,000. Judging the likelihood to be high, it pays for redundant hosting and DDoS protection, then transfers part of the residual risk to its insurer.
