5  Risk Management

Pixel-art illustration: an overhead view of a war-room table with a parchment map and bowls of counting tokens by candlelight.

You can’t protect everything equally, so you don’t. Risk management is how a defender decides where the money and effort go.

Everything before this chapter was about how to defend: controls, cryptography, layered defence. This chapter is about where to spend the effort. It is the moment security stops being a technical subject and becomes a business one. No organisation has unlimited money, time, or patience, so a defender who tries to protect everything equally protects nothing well. Risk management is the discipline of deciding, honestly and defensibly, what to protect, how much to spend, and what to leave alone. It is also where “assume breach” turns into a budget.

5.1 What this chapter covers

By the end you should be able to:

  • Define risk, risk appetite, and explain why appetite varies between organisations.
  • Explain cost-benefit analysis and the difference between intrinsic and acquired value.
  • Calculate single loss expectancy (SLE) and annual loss expectancy (ALE), and use them to judge whether a control is worth it.
  • Describe the main risk treatments: avoid, mitigate, transfer, accept.

5.2 What risk actually is

In everyday speech “risk” means danger. In security it means something more precise and useful: risk is the combination of how likely something bad is and how much it would hurt if it happened. A useful shorthand is risk = likelihood × impact. Neither alone tells you much. A catastrophic event that almost never happens may be a smaller risk than a minor one that happens weekly. Treating them as equal, as a fear-driven approach does, wastes effort on the dramatic and ignores the routine.

Because risk is about likelihood and impact, it is always relative to a particular organisation. That is where risk appetite comes in: how much risk a given organisation is willing to accept in pursuit of its goals. A hospital and a social-media start-up face different threats, value different things, and answer to different regulators, so they will rationally accept different risks. Risk appetite is a deliberate statement of how much uncertainty an organisation will live with. It is neither recklessness nor timidity. Two well-run companies facing the same threat can make opposite, equally defensible decisions. They should be able to explain the constraints behind those choices.

5.3 What are you protecting, and what’s it worth?

You cannot judge a risk without knowing the value of what’s at stake, and value is subtler than a price tag. An asset has intrinsic value (what it is worth in itself, like the replacement cost of a server) and acquired value (the worth it takes on from its role and context). A customer database might contain a few dollars of storage, but the acquired value (the trust, the regulatory exposure, the competitive harm if it leaked) can be enormous. Defenders who price only the intrinsic value under-protect the things that matter most, because the damage from losing information usually dwarfs the cost of the hardware holding it.

Once you can value what’s at stake, you can do cost-benefit analysis: weigh what a control costs against the loss it prevents. This provides one input to a security decision. It has an uncomfortable implication people resist: sometimes the right answer is to not buy the control, because it costs more than the harm it prevents. That judgement is constrained by legal duties, safety and the organisation’s stated limits. A positive financial return is not the only reason to protect people.

5.4 Putting numbers on it: SLE, ARO, ALE

To make cost-benefit concrete, security borrows a simple model from insurance. Three quantities do the work. Single Loss Expectancy (SLE) is how much one occurrence of the event would cost you. Annualised Rate of Occurrence (ARO) is how many times a year you expect it to happen, and it can be a fraction: 0.2 means once every five years. Annual Loss Expectancy (ALE) is the expected cost per year, SLE × ARO.

Here is a worked example. Suppose a breach of your customer database would cost about $500,000 to clean up, notify, and recover from. That is the SLE. You judge such a breach might happen once every five years, so the ARO is 0.2. The annual loss expectancy is:

ALE = SLE × ARO = \$500,000 × 0.2 = \$100,000 per year.

That $100,000 is what this risk “costs” you in expectation each year, and it’s the number a control has to beat.

5.5 Is the control worth it?

Now you can judge a control honestly. Say better monitoring and encryption cost $40,000 a year and would cut the breach rate to once every twenty years (ARO 0.05). The new annual loss expectancy becomes \$500,000 × 0.05 = \$25,000. So the control reduces your ALE from $100,000 to $25,000, a benefit of $75,000 a year, for a cost of $40,000. It saves you $35,000 net, so it is worth buying.

For this financial model, a control has positive expected net benefit when the reduction in ALE exceeds its annual cost. That is not a complete acceptance rule for safety, privacy or regulatory obligations. Turn the numbers around and the answer flips. A $50,000 control that only reduces an ALE from $30,000 to $5,000 loses you money, and buying it out of a vague sense that “more security is better” is the mistake this chapter exists to prevent.

Two honest cautions come with the arithmetic. First, notice that even after the good control, $25,000 of annual risk remains: this is residual risk, the risk left over after treatment. You almost never reduce risk to zero, and pretending otherwise is how organisations get surprised. Second, these numbers are estimates: SLE and ARO are educated guesses, and some impacts (a ruined reputation, harm to people, loss of life) resist being priced at all. Treat quantitative risk analysis as a discipline for thinking clearly. The numbers structure the judgement; they do not replace it.

5.6 The four things you can do with a risk

Once a risk is identified and sized, you have four options. They are the vocabulary every security professional shares:

  • Avoid. Don’t do the risky thing at all. Stop offering the feature, don’t collect the data, close the exposure. This can remove the particular exposure, but may introduce other risks. It is often impractical because the activity is part of the business.
  • Mitigate. Reduce the likelihood or the impact with controls. This is most of what the rest of this book is about: patch, encrypt, segment, train, monitor. You rarely eliminate the risk; you shrink it to an acceptable size.
  • Transfer. Share specified financial consequences through insurance or a contract. Coverage, exclusions and provider obligations matter. Outsourcing does not automatically transfer your responsibility for customers or legal compliance.
  • Accept. Decide the risk is small enough, or the fix too costly, to live with it. This is a legitimate, deliberate choice, provided it’s made consciously and by someone with the authority to make it. Record the owner, reasoning, residual exposure and review date. An unexamined risk is not the same as deliberate acceptance.

Organisations use resources with different purposes: the ASD Essential Eight sets out mitigation strategies and maturity expectations; ISO/IEC 27001 specifies an information-security management system; the NIST Cybersecurity Framework organises cybersecurity outcomes. They are not interchangeable pass/fail checklists. The NIST CSF provides a starting point for understanding outcomes and governance. Use the framework to structure evidence and responsibilities, then explain how the chosen treatment addresses the organisation’s actual exposure.

TipPlay it

Incident Zero’s Audit & Compliance module has you score an organisation’s controls pass/fail against a real framework, and then defend your judgement to the table. It turns the abstract choice between accept, mitigate, transfer, avoid into a call you have to argue for out loud. → incidentzero.retroverse.studio

5.7 Where this connects

The next chapter, incident and disaster planning, is what you do when a risk you accepted or mitigated happens anyway. Every control elsewhere in the book is a mitigation, and this chapter is how you decide which ones are worth deploying. A maturity assessment against a standard like the Essential Eight is this same risk-based reasoning, applied control by control.

5.8 Questions to consider

  1. Two companies face the same threat but treat it differently. One buys insurance, one consciously accepts it. How can both be rational?
  2. A control costs $50k/year and reduces an ALE of $30k/year to $5k/year. Should they buy it? Show your reasoning.
  3. Give a real risk your own organisation (or somewhere you’ve studied or worked) probably accepts rather than fixes. Why is that a defensible choice?

5.9 Calculate, then challenge

In 15 minutes, calculate Harbour’s expected-loss reduction and net benefit for option A. Repeat for post-control annual rates 0.02 and 0.09. Then choose an affordable set of controls and record what it leaves unresolved. Success requires correct arithmetic, stated assumptions and a named risk owner; a positive estimate alone is not approval to ignore binding duties.

Case inputs and checks: Harbour dossier.

5.10 Take it to the AI

Optional: attempt the paper task first. Use only the fictional case, never real messages, credentials, personal information or internal logs. Check any external claims against the primary sources; do not deploy generated rules.

Act as a reviewer of my fictional Harbour risk decision. Identify the assumption most likely to change my conclusion. Use only the printed costs and estimates; do not invent product effectiveness. Ask one question, wait for my answer, then explain how I could obtain better evidence.