Risk and outcomes

Risk is not a vague sense of worry. It is a calculable quantity, even when precise numbers are unavailable. Understanding its components is the first step toward managing it systematically rather than reacting to incidents after the fact.

The core formula is: Risk = Likelihood x Impact. Likelihood is the probability that a given event occurs. Impact is the severity of the harm if it does. Neither dimension alone determines risk. A highly likely event with negligible impact, such as a user forgetting their password, is low risk. A very unlikely event with catastrophic impact, such as a nation-state attack destroying critical infrastructure, may still warrant significant investment.

The SolarWinds scenario illustrates this well. Before the compromise was discovered, a security team might have assessed "malicious code inserted into third-party software update" as low likelihood but very high impact. Had that risk been formally scored and placed on a register, it might have prompted controls such as software bill of materials (SBOM) verification or network segmentation for Orion systems. Most organisations did not formally assess it. The result was a 9-month undetected breach.

These three terms appear frequently in news coverage and are often used interchangeably. They describe distinct concepts in the risk formula, and confusing them leads to incomplete defences.

A threat is any potential cause of an unwanted incident. Threats can be natural (flooding a server room), accidental (an employee deleting the wrong file), or intentional (a criminal group seeking to steal financial data). A threat exists whether or not there is anything it can exploit.

A vulnerability is a weakness in a system, process, or control that a threat could exploit. Vulnerabilities can be technical (unpatched software), procedural (no verification process for fund transfers), or physical (an unlocked server room door).

An exploit is the actual mechanism or technique used to take advantage of a vulnerability. When an exploit is successfully applied, a threat is realised and an incident occurs. The term is also used as a noun for a specific piece of code designed to trigger a particular vulnerability.

One practical consequence links straight back to the risk formula. The likelihood of a threat is not a number plucked from the air: it follows from the actor economy set out in Who attacks and why, where each actor class has its own motives, typical entry routes and success conditions. A weakness that a well-resourced group is actively hunting carries a higher likelihood than the same weakness nobody has any reason to target, which is why threat and vulnerability have to be read together rather than scored in isolation.

The Target 2013 data breach illustrates why this distinction matters operationally. In November 2013, attackers stole approximately 40 million payment card details from Target, the US retailer. The threat was an organised criminal group. The vulnerability was a combination of network segmentation failures that allowed a third-party HVAC (Heating, Ventilation, and Air Conditioning) vendor's access to reach payment systems, along with security alerts that were generated but not acted upon. The exploit was malware deployed on point-of-sale terminals via stolen vendor credentials. Understanding these as distinct concepts means understanding that better segmentation, stronger vendor controls, or acting on the alerts could each have prevented the breach independently.

Once risks are understood, organisations must decide how much of them they are willing to accept. Two related terms describe this decision-making at different levels.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives. It is a strategic-level statement, typically set by senior leadership or a board. An organisation with a high risk appetite for rapid product development may simultaneously have a very low risk appetite for handling children's personal data.

Risk tolerance is the acceptable variation around a risk appetite statement. Where appetite sets the direction, tolerance sets the operational boundary. A hospital might set an appetite of "we will not accept risks that could compromise patient safety" and a tolerance of "we accept that up to 0.5% of routine IT changes will cause minor service disruption, but not outages exceeding 30 minutes."

The risk register is the primary operational tool for tracking identified risks. A register entry typically includes: a unique risk ID, a description of what could happen and why, likelihood and impact ratings on a defined scale, a risk owner, current controls already in place, a planned treatment action, and a review date.

After identifying and scoring a risk, four treatment options apply. Mitigate means reducing likelihood or impact through controls. This is the most common approach when controls are cost-effective. Accept means acknowledging the risk without additional controls, appropriate when the cost of mitigation exceeds the potential impact. Transfer shifts the financial impact to a third party, typically through insurance. Avoid means stopping the activity that creates the risk, used when risk cannot be reduced to an acceptable level.

A risk conversation eventually reaches a practical question: what is the minimum an organisation should have in place before anything else is argued about? In the UK the common answer is Cyber Essentials, the Government-backed baseline scheme run by the NCSC. It certifies that an organisation has a small set of fundamental technical controls in place, the everyday hygiene that turns away the most common attacks.

The scheme is a live standard, not a fixed one. Its self-assessment question set is named Willow, and version 3.2 applies from 28 April 2025. That revision accepts passwordless FIDO2 authentication as a valid method, renames patching as "vulnerability fixes" to state the requirement more plainly, and brings all the cloud services an organisation uses into scope rather than leaving parts of the estate outside the assessment. The direction of travel is the same each year: close the gaps that commodity attackers rely on.

The value of a baseline is exactly that it removes the cheap, untargeted attacks that make up most of the volume, the opportunistic scanning, the reused credentials, the unpatched internet-facing service. What it does not do is prove resistance to an adversary who has chosen you specifically and will spend time and money to get in. That is why Cyber Essentials belongs in a risk conversation as a floor to stand on, not as the conclusion of one: it lifts an organisation above the background noise, and everything earlier in this module, appetite, tolerance, treatment and the register, still applies to the targeted risks a baseline was never designed to stop.