Risk assessment techniques for cybersecurity

A risk assessment is only useful if it ends in a ranked list, not a long document nobody re-reads. The method matters less than the discipline of finishing it: identify what you have, work out what could go wrong with it, and rank the results by how likely and how costly each scenario actually is.

1. Identify the assets

Start with what you're protecting, not what you're afraid of. That means systems, data stores, third-party integrations, and the people who can act on all of them. An asset you haven't listed is a risk you can't assess.

2. Identify threats and vulnerabilities

For each asset, ask what could go wrong (the threat) and what would let it happen (the vulnerability). A threat without an exploitable weakness is low priority; a weakness nobody would bother exploiting is lower still. It's the combination that matters.

3. Score by likelihood and impact

Qualitative scoring (low/medium/high) is faster and good enough for most organisations starting out. Quantitative scoring (estimated financial loss, probability over a time window) is more defensible when you need to justify budget. Either way, score likelihood and impact separately before combining them — a rare, catastrophic event and a common, minor one can land at the same score for very different reasons.

4. Rank and register

The output is a risk register: each finding, its score, and an owner. Rank order is the point — it tells you what gets fixed this quarter versus what gets monitored.

Treat the register as a living document. New systems, new integrations and new regulatory requirements all change the ranking, so revisit it on a schedule rather than only after something goes wrong.