In Week 2 you learned to describe how an attack happens: a threat actor uses an attack vector to exploit a vulnerability in a target asset. But knowing that a risk exists is not the same as knowing what to do about it. This lesson turns a list of threats into a ranked list of priorities using the most common tool in security management: the risk matrix, which scores each risk by Likelihood × Impact.
Risk is the potential for loss when a threat exploits a vulnerability affecting an asset. It is measured as the combination of how probable that event is and how bad it would be:
A quick reminder of the building blocks from Week 2:
| Term | Meaning | Example |
|---|---|---|
| Threat | A potential cause of harm | A hacker, malware, a natural disaster |
| Vulnerability | A weakness that could be exploited | Unpatched software |
| Risk | The combination of likelihood and impact if that threat exploits that vulnerability | “Ransomware via phishing on the patient database: Possible × Severe” |
Diagram loads as you scroll.
Common mistake: treating a threat or a vulnerability on its own as “a risk”. A hacker with no weakness to exploit, or a weakness nobody can reach, is not yet a risk. Risk exists only when a threat, a vulnerability and an asset come together, and it is always described with both a likelihood and an impact.
No organization can fix every vulnerability, block every threat actor, or eliminate every risk. Every organization has limits:
Risk assessment answers the question “Which problems do we deal with first?” In the words of the course: risk assessment turns a long list of problems into a short list of priorities.
| Qualitative | Quantitative | |
|---|---|---|
| How it works | Rate Likelihood and Impact on a simple scale (e.g. Low–Medium–High, or 1–5) using judgment and experience | Assign monetary values (approaches such as FAIR or Annualized Loss Expectancy, ALE) to express risk in money |
| Strengths | Fast and intuitive; no hard data required | Precise; defensible in a budget case |
| Weaknesses | Approximate and subjective | Needs reliable data; much more effort |
| Typical use | What most organizations use day-to-day | Major or high-stakes decisions |
This lesson covers the qualitative approach. The quantitative approach (SLE and ALE) is covered in 3.2.
| Score | Label | Meaning |
|---|---|---|
| 1 | Rare | May occur only in exceptional circumstances |
| 2 | Unlikely | Could occur, but not expected |
| 3 | Possible | Might occur at some point |
| 4 | Likely | Will probably occur in most circumstances |
| 5 | Almost Certain | Expected to occur, possibly more than once |
Likelihood should be grounded in evidence wherever possible: the organization’s own incident logs, industry reports, and known threat activity (for example, “phishing emails reach our staff every week” supports a high likelihood for phishing-based risks).
| Score | Label | Meaning |
|---|---|---|
| 1 | Negligible | Little to no disruption |
| 2 | Minor | Small, easily-absorbed disruption |
| 3 | Moderate | Noticeable disruption to operations |
| 4 | Major | Serious disruption; possible harm to people or trust |
| 5 | Severe | Threatens the organization’s ability to operate |
Think back to the CIA Triad (Week 1) when judging impact: impact usually means damage to Confidentiality (patient records leaked), Integrity (medication doses altered) or Availability (EHR down during surgery). Naming the CIA property affected is a quick way to justify an impact score in an exam answer.
Multiply the two scores to get the risk score, then convert the score into a risk level:
Risk score (each 1–5, so the score is 1–25).
Risk level Score Low 1–4 Medium 5–9 High 10–16 Critical 17–25 (i.e. above 16)
Plotting every possible combination gives the 5 × 5 risk matrix (Impact up the side, Likelihood along the bottom):
| Impact ↓ / Likelihood → | 1 Rare | 2 Unlikely | 3 Possible | 4 Likely | 5 Almost Certain |
|---|---|---|---|---|---|
| 5 Severe | 5 Medium | 10 High | 15 High | 20 Critical | 25 Critical |
| 4 Major | 4 Low | 8 Medium | 12 High | 16 High | 20 Critical |
| 3 Moderate | 3 Low | 6 Medium | 9 Medium | 12 High | 15 High |
| 2 Minor | 2 Low | 4 Low | 6 Medium | 8 Medium | 10 High |
| 1 Negligible | 1 Low | 2 Low | 3 Low | 4 Low | 5 Medium |
Reading the matrix: risks in the top-right corner (likely and damaging) are the priorities; risks in the bottom-left corner (rare and minor) can usually be watched rather than fixed.
MediCare Plus’s patient database faces ransomware via phishing. Phishing emails arrive regularly but staff do sometimes report them, so the group rates Likelihood 3 (Possible). Encrypted patient records would stop clinical work, so Impact is 5 (Severe). Score , which falls in 10–16, so the risk level is High.
Common mistakes with the matrix:
- Adding instead of multiplying. would wrongly give Medium; the correct score is (High).
- Mixing up the boundaries. 16 is still High; Critical starts above 16. 4 is still Low; Medium starts at 5.
- Swapping the axes. “Almost Certain” is a likelihood label; “Severe” is an impact label. Keep the two scales separate.
Qualitative scores are not “right” or “wrong” in the way a calculation is. Two reasonable analysts may give the same risk a 3 or a 4. What matters is the justification: each score should point to a specific fact (evidence of past incidents, how exposed the system is, which CIA property is damaged, who would be harmed). In the Week 3 group activity, groups score the five asset–threat pairs they mapped for MediCare Plus in Week 2, plot them, and must be ready to defend their numbers, since there is often more than one reasonable answer. Not every risk needs to be Critical.
The risk matrix is not just a classroom exercise. Two widely used frameworks describe the same process:
Different organizations use different frameworks, but the underlying logic is the same:
Diagram loads as you scroll.
A MediCare Plus group rates the risk “patient billing records stolen through an unpatched web portal” as Likelihood 4 (Likely) and Impact 5 (Severe). Calculate the risk score and state the risk level.
Multiply the two scores:
Compare with the bands: Low 1–4, Medium 5–9, High 10–16, Critical 17–25. Since 20 is above 16, the risk is in the Critical band.
Score = 20, Risk Level = Critical.
Calculate the score and risk level for each of the following, then rank them from highest to lowest priority.
| Risk | Likelihood | Impact |
|---|---|---|
| A. Guest Wi-Fi used to stream illegal content | 4 | 1 |
| B. EHR outage from a failed storage disk | 2 | 4 |
| C. Infusion pump settings altered over the network | 2 | 5 |
| D. Staff password reused on a breached website | 4 | 4 |
Multiply Likelihood × Impact for each row, then apply the bands.
| Risk | Calculation | Score | Level |
|---|---|---|---|
| A | 4 | Low | |
| B | 8 | Medium | |
| C | 10 | High | |
| D | 16 | High |
Notice the boundary cases: A (score 4) is still Low, and D (score 16) is still High, not Critical.
Ranking: D (16, High) → C (10, High) → B (8, Medium) → A (4, Low).
(Mini-case) MediCare Plus’s IT Manager says: “Our guest Wi-Fi is attacked constantly, so it must be our top risk.” The guest network is fully separated from clinical systems and only offers internet access to visitors. Using the risk matrix, explain whether the IT Manager is right.
Risk depends on both likelihood and impact, not on how often attacks happen alone.
A risk such as ransomware on the patient database (, High) clearly outranks it.
The IT Manager is wrong: a very likely event with negligible impact scores only 5 (Medium); frequency alone does not make a top risk.
Using only whole-number scores from 1 to 5, list every score that can actually fall in the Critical band. What does this tell you about which risks can ever be Critical?
The Critical band is 17–25. The possible products of two numbers from 1 to 5 that are above 16 are:
No pair gives 17, 18, 19, 21, 22, 23 or 24 (for example, 18 would need , and 6 is off the scale).
So a Critical risk must have both scores at 4 or higher, with at least one of them at 5.
Only scores 20 and 25 can be Critical, so a risk is Critical only when it is at least Likely (4) and Major (4), with one of them at the top of its scale (5).
(Conceptual) Give two advantages and two limitations of qualitative risk assessment compared with quantitative assessment, and say when each approach is the better choice.
Advantages of qualitative assessment
Limitations
When to use each