--- title: 'Risk Definition' source: 'https://academia.sh/en/courses/introduction-to-cybersecurity/risk-definition' course: 'Introduction to Cybersecurity' language: en updated: '2026-10-21T05:02:56+00:00' license: 'CC BY-SA 4.0' objectives: - 'Calculates risk as the product of probability and impact over a set of items and derives the ranking' - 'Runs banded and threshold-based scoring over the same list and counts the rank shifts' - 'Converts the ranking difference into a budget: what share of expected loss closes once a given number of items are addressed' --- # Risk Definition Calculating risk as the composition of probability and impact: in a 12-item list the total expected loss comes to 176.05 fictional units; banded scoring changes the rank of 9 items in the same list, carries the largest shift to 6 positions, and leaves only 2 of the top five shared; for threshold scoring those numbers are 7, 4, and 4; a four-item budget closes 77.00, 67.60, and 71.40 units across the three scoring schemes; and two items carrying the same 18.00 expected loss produce 4.0 and 0.3 events over ten years. The previous lesson counted nineteen triples and wrote every one of them at equal weight. Closing order was built purely from triple count carried; but how often an item actually occurs, and what it costs when it does, was not inside that number. This lesson adds those two dimensions and puts the list in order. **Risk** is the composition of an event's **probability** and its **impact**. In its plainest form, risk is written as probability × impact, and the resulting number is called **expected loss**. Vulnerability is a list, risk is a number; when the two are conflated, a zero-probability vulnerability and a frequently occurring item end up on the same row. What this lesson shows is that composition does not have a single form: the same two inputs produce three separate rankings, and the choice of ranking decides where the budget goes. ## Risk Is a Product The items are the previous lesson's vulnerability list. The probability and impact values below are a **model**: there is no real event record, no real probability estimate, no real currency. Impact is denominated in **fictional units**. **SC11:** every item carries a probability and an impact; probability is the likelihood of occurring within a one-year window, impact is the loss in fictional units. **SC12:** expected loss is the product of probability and impact. **SC13:** banded scoring reduces probability and impact each to a band between 1 and 5 and multiplies the two bands. **SC14:** threshold scoring puts items with impact of 100 fictional units or above first, then ranks them among themselves by expected loss. **SC15:** the budget covers four items in one round. Ties do not disturb list order. ```js // security/risk.mjs — fictional measurement network's risk items (model): no real event record, // no real probability estimate, no real currency. Impact is denominated in "fictional units". // SC11: items are the previous lesson's vulnerability list; probability is the likelihood of // occurring within a one-year window, impact is the loss in fictional units. export const ITEM = ` outdated-library-version 0.40 45 default-password 0.60 28 broad-read-permission 0.18 110 unvalidated-input 0.50 40 open-management-endpoint 0.12 160 unsigned-update 0.03 600 shared-account 0.45 30 unencrypted-transfer 0.25 55 unretained-log 0.70 14 outdated-agent-version 0.55 20 physical-access-point 0.06 240 unvalidated-field 0.02 90` .trim().split("\n").map((r, i) => { const [name, p, e] = r.trim().split(/\s+/); return { i, name, p: +p, e: +e, expected: +(+p * +e).toFixed(2) }; }); // SC13: banded scoring reduces probability and impact to a 1..5 band and multiplies the bands. const band = (x, limit) => limit.findIndex((s) => x < s) + 1 || limit.length + 1; export const pBand = (k) => band(k.p, [0.05, 0.15, 0.30, 0.50]); export const iBand = (k) => band(k.e, [20, 50, 100, 200]); export const bandScore = (k) => pBand(k) * iBand(k); // SC14: threshold scoring puts items with impact 100 fictional units or above first. export const THRESHOLD = 100; // Rankings: ties do not disturb list order (stable sort). export const RANK = { A: [...ITEM].sort((x, y) => y.expected - x.expected || x.i - y.i), B: [...ITEM].sort((x, y) => bandScore(y) - bandScore(x) || x.i - y.i), C: [...ITEM].sort((x, y) => (y.e >= THRESHOLD) - (x.e >= THRESHOLD) || y.expected - x.expected || x.i - y.i), }; export const rank = (name, k) => RANK[name].findIndex((x) => x.name === k.name) + 1; export const TOTAL = +ITEM.reduce((a, k) => a + k.expected, 0).toFixed(2); ``` ```js // security/rank.mjs — same items, three scoring schemes: how the rank shifts, what it does to budget. import { ITEM, RANK, THRESHOLD, TOTAL, pBand, iBand, bandScore, rank } from "./risk.mjs"; const write = (g, ...s) => console.log(s.map((v, i) => (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join("")); const BUDGET = 4; // SC15: budget covers four items in one round console.log(`${ITEM.length} items; risk = probability x impact (fictional units). ` + `total expected loss ${TOTAL} units; A expected loss, B banded product (1..5 x 1..5), ` + `C threshold that puts impact ${THRESHOLD} and above first`); const A = [-27, 7, 8, 10, 5, 8, 7, 5, 5, 5]; console.log("\n1. same items, three scoring schemes"); write(A, "item", "prob", "impact", "expected", "p-b", "i-b", "band", "A", "B", "C"); for (const k of ITEM) write(A, k.name, k.p.toFixed(2), k.e, k.expected.toFixed(2), pBand(k), iBand(k), bandScore(k), rank("A", k), rank("B", k), rank("C", k)); const B = [-30, 9, 9]; console.log("\n2. compared to A"); write(B, "measure", "B", "C"); const shift = (name) => ITEM.map((k) => Math.abs(rank("A", k) - rank(name, k))); const topFive = (name) => RANK[name].slice(0, 5).filter((k) => RANK.A.slice(0, 5).includes(k)).length; for (const [name, f] of [["items with changed rank", (s) => shift(s).filter((x) => x > 0).length], ["largest rank shift", (s) => Math.max(...shift(s))], ["total absolute shift", (s) => shift(s).reduce((a, x) => a + x, 0)], ["top five shared", (s) => topFive(s) + "/5"]]) write(B, name, f("B"), f("C")); const C = [-16, 26, 10, 9, 10]; console.log(`\n3. budget ${BUDGET} items: which scheme picks what`); write(C, "scheme", "A-rank of picks", "closed", "share %", "tail"); const biggest = ITEM.reduce((a, k) => (k.e > a.e ? k : a)); for (const name of ["A", "B", "C"]) { const pick = RANK[name].slice(0, BUDGET); const closed = +pick.reduce((a, k) => a + k.expected, 0).toFixed(2); write(C, name, pick.map((k) => rank("A", k)).join(" "), closed.toFixed(2), ((closed / TOTAL) * 100).toFixed(1), pick.includes(biggest) ? "inside" : "outside"); } console.log(`tail = single largest impact (${biggest.name}, ${biggest.e} units)`); const D = [-27, 9, 8, 11, 8]; console.log("\n4. same expected loss, separate decision"); write(D, "item", "prob", "impact", "expected", "band"); const tied = ITEM.filter((k) => ITEM.some((x) => x !== k && x.expected === k.expected)); for (const k of tied) write(D, k.name, k.p.toFixed(2), k.e, k.expected.toFixed(2), bandScore(k)); console.log(`over ten years the expected total is equal; a single event loses ` + `${tied.map((k) => k.e).join(" and ")} units, and the expected event count over ten years is ` + `${tied.map((k) => (k.p * 10).toFixed(1)).join(" and ")}`); const running = RANK.A.map(((s) => (k) => (((s += k.expected) / TOTAL) * 100).toFixed(1))(0)); console.log(`\ncumulative coverage in A order (%): ${running.join(" ")}`); ``` ``` 12 items; risk = probability x impact (fictional units). total expected loss 176.05 units; A expected loss, B banded product (1..5 x 1..5), C threshold that puts impact 100 and above first 1. same items, three scoring schemes item prob impact expected p-b i-b band A B C outdated-library-version 0.40 45 18.00 4 2 8 4 7 6 default-password 0.60 28 16.80 5 2 10 6 2 7 broad-read-permission 0.18 110 19.80 3 4 12 2 1 1 unvalidated-input 0.50 40 20.00 5 2 10 1 3 5 open-management-endpoint 0.12 160 19.20 2 4 8 3 8 2 unsigned-update 0.03 600 18.00 1 5 5 5 10 3 shared-account 0.45 30 13.50 4 2 8 9 9 9 unencrypted-transfer 0.25 55 13.75 3 3 9 8 6 8 unretained-log 0.70 14 9.80 5 1 5 11 11 11 outdated-agent-version 0.55 20 11.00 5 2 10 10 4 10 physical-access-point 0.06 240 14.40 2 5 10 7 5 4 unvalidated-field 0.02 90 1.80 1 3 3 12 12 12 2. compared to A measure B C items with changed rank 9 7 largest rank shift 6 4 total absolute shift 30 14 top five shared 2/5 4/5 3. budget 4 items: which scheme picks what scheme A-rank of picks closed share % tail A 1 2 3 4 77.00 43.7 outside B 2 6 1 10 67.60 38.4 outside C 2 3 5 7 71.40 40.6 inside tail = single largest impact (unsigned-update, 600 units) 4. same expected loss, separate decision item prob impact expected band outdated-library-version 0.40 45 18.00 8 unsigned-update 0.03 600 18.00 5 over ten years the expected total is equal; a single event loses 45 and 600 units, and the expected event count over ten years is 4.0 and 0.3 cumulative coverage in A order (%): 11.4 22.6 33.5 43.7 54.0 63.5 71.7 79.5 87.2 93.4 99.0 100.0 ``` Numbers belong to the **measurement** class; their inputs are SC11–SC15. ## Same List, Three Separate Rankings The second table is this lesson's central finding. The input has not changed — the same twelve items, the same probability, the same impact. Only the way they are composed has changed. Banded scoring **changes the rank of nine items**, the largest shift is **six positions**, and the total absolute shift is 30. Only **two** of the top five are shared. Threshold scoring is milder: seven items change place, the largest shift is four, and four of the top five are shared. The first table shows item by item where the shift comes from. `outdated-agent-version` sits **tenth** in the expected-loss ranking (11.00 units), and **fourth** in the banded ranking. The reason is where the bands are drawn: a probability of 0.55 falls into the top band (5), an impact of 20 units falls into the second band (2), and the product is 10. The same score of 10 goes to `physical-access-point`, whose impact is 240 units and whose expected loss is 14.40 units. **Banding pulls the two ends toward each other.** In the opposite direction sits `open-management-endpoint`: it has an expected loss of 19.20 units and ranks third, but drops to eighth in the banded ranking. Its probability is 0.12 and falls into the second band; yet there is no real gap between 0.12 and 0.18, only the 0.15 boundary. `broad-read-permission` at 0.18 enters the third band and comes out first in the banded ranking. **What sets the order between the two items is not the gap between them, but where the boundary was placed.** The band itself is not a flaw; estimating probability to two decimal places of precision is not possible for most items, and the band removes that false precision. What is measured here is this: in place of the false precision the band removes, a second false precision arrives, and this second one is strong enough to change the ranking of nine items. ## Budget Turns Ranking into a Decision A rank difference on its own is just a debate; the third table turns it into a decision. If a round can cover four items, the expected-loss ranking picks the top four and closes **77.00 units**, or **43.7%**, of the 176.05-unit total. The banded ranking, on the same budget, picks the items ranked 2nd, 6th, 1st, and 10th in the expected-loss order and closes **67.60 units** (38.4%). The gap of 9.40 units is **the cost of the scoring form.** Threshold scoring sits in the middle: it closes 71.40 units (40.6%). But it is the only one of the three scoring schemes that pulls the single largest impact — the 600-fictional-unit `unsigned-update` item — inside the budget. The expected-loss ranking puts it fifth, and the four-item budget leaves it outside; the banded ranking puts it tenth. This row shows that expected loss has a blind spot of its own. Expected loss measures an **average**; an average is the right number for events that repeat over a long stretch of time. For an event that loses 600 units in a single occurrence, the average does not say whether the organization can carry that loss. Threshold scoring corrects for this with a blunt rule, and gives up 5.60 units of expected-loss coverage in return. ## There Is No Tail in This List The last row tests one of ranking's assumptions. Priority lists are usually built on the expectation that a handful of items carry most of the total, and fixing that handful finishes most of the job. The cumulative-coverage sequence in this list records that the expectation is not met. The first item carries **11.4%** of the total, the first three carry **33.5%**, the first six carry **63.5%**. Passing 90% coverage takes ten items. When the distribution is this flat, the meaning of a priority list changes. In a list with a heavy tail, the scoring form is not up for debate, because whichever form is used, the same two or three items stay on top. In a flat list, the scoring form itself is the decision — which is exactly what this lesson's second table records when it shows nine items changing place, and the third table when it shows the gap between them at 9.40 units. A second conclusion follows from the same sequence: the items at the bottom of the list are not negligible. The last three items carry **12.8%** of the total; even the lowest, `unvalidated-field`, writes 1.80 units — and this is exactly the item that carried zero triples in the previous lesson. **Zero access paths does not mean zero risk**, because probability does not come only from today's access situation. In a flat distribution, wherever the cutoff is placed, the items left outside carry a share of the total that is not small, and that share counts as **accepted** — and unless it is counted and written down, no one even notices it was accepted. ## Same Product, Separate Decision The fourth table sets two items side by side: `outdated-library-version` and `unsigned-update`. Their expected losses are **exactly equal** — 18.00 fictional units. Their banded scores are 8 against 5. Over a ten-year window, the total expected loss from each is equal too. The only thing that is not equal is the distribution. The first occurs an average of **4.0 times** over ten years and writes 45 units each time; the second occurs **0.3 times** and, when it does, writes 600 units. The first item is an operating expense: predictable, budgetable, carried a bit at a time. The second is a disruption: in most ten-year windows it does not happen at all, and in the window where it does, that single item writes more than three times the entire annual expected loss. Two items reduced to the same number therefore call for two separate decisions. For the first, the right question is "how many times will it happen, and what will the total come to"; for the second, "can we stay standing when it happens". The two questions look at two separate forms of defense: for the frequent, small item, what should be measured is the per-unit reduction — cutting each event's cost from 45 to 30 is a real gain across 4.0 events in ten years. For the rare, large item, the same reduction means almost nothing; what should be measured there is whether the event happens **at all**, or whether the 600 units can be spread out when it does. **Expected loss is a ranking tool, not a threshold tool.** A risk number is therefore never sufficient on its own; unless the composition that produced it and the distribution it conceals are written down alongside it, the same 18.00 hides two different decisions. ## Summary - Risk is the composition of probability and impact; its plainest form is expected loss, and across the twelve-item list it totals 176.05 fictional units. - Three rankings come from the same input: banded scoring changes the rank of nine items, the largest shift is six positions, and only two of the top five are shared; for threshold scoring those numbers are 7, 4, and 4. - Banding pulls the two ends together: an item worth 11.00 units and one worth 14.40 units get the same score of 10; what sets the order is not the gap but where the boundary is placed. - A four-item budget closes 77.00 (43.7%), 67.60 (38.4%), and 71.40 (40.6%) units across the three scoring schemes; the gap of 9.40 units is the cost of the scoring form. - Only threshold scoring pulls the single largest impact into the budget, giving up 5.60 units of expected-loss coverage in return. - Two items carrying the same 18.00 expected loss produce 4.0 and 0.3 events over ten years; one is an operating expense, the other is a question of whether the organization can carry the loss. ## Next Step This lesson counted every item as a single event: probability given, impact given, multiplied. But the 600-unit impact of the `unsigned-update` item is not born in a single moment. First something is reached, then a weakness is triggered, then something is executed, then privilege expands, and impact is only written once all of these have completed. The number we call probability is actually the probability of this **chain completing from start to end**. The next lesson breaks the chain into its steps and counts how many paths breaking a given step closes.