Glossary term
Cybersecurity Risk
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: Cyber risk
Cybersecurity risk is the potential for loss from attacks on, or failures of, information systems, including damage to data, operations, finances and reputation.
Explanation
It is usually assessed as a combination of threats (who might attack and how), vulnerabilities (weaknesses they could exploit) and impact (what would be lost). Typical threat sources are criminal groups, state-backed actors, hacktivists, insiders and suppliers whose own systems are breached. The risk is managed alongside other operational risk, using frameworks such as the NIST Cybersecurity Framework or ISO 27001 and a register of cyber risks with owners, controls and ratings. Boards set cyber risk appetite, a statement of how much cyber loss or downtime they will accept, often turned into limits such as maximum tolerable outage for key systems and target times for patching serious flaws. Residual risk, what remains after controls, is tracked and reported. Risk committees use the rating to rank which systems get funding first, so a stale assessment sends money to the wrong place.
Example
A regional airline rates its cyber risk as high because it holds millions of passenger records and relies on one booking platform. The board sets an appetite of no more than 24 hours of downtime for that platform. Testing shows that recovery would take three days, so the risk is rated above appetite, and funding is approved for a standby site.
Not to be confused with
- Technology Risk Management
- Technology risk covers IT failures of any cause, including errors and outages; cybersecurity risk is the part driven by hostile or unauthorised activity.