Risk assessment: likelihood × impact

Risk is how likely something bad is, multiplied by how bad it would be. A common tool is a 5×5 matrix: rate likelihood and impact from Very low (1) to Very high (5), multiply, and fix the highest scores first. Score impact as the worst credible outcome across a few impact categories (financial, operational downtime, legal and regulatory, reputation, safety and privacy), and define each level in advance with concrete thresholds (for example, “Major = more than a day of outage”), so two people score the same event the same way.

For a quick likelihood estimate, ask three questions. Exposed? Can an attacker actually reach it? Easy? Is there a public exploit, and does it need a login? Active? Is it in CISA's KEV catalog, in your threat intelligence, or hitting your peers? Each “yes” pushes likelihood up; controls that genuinely block the path push it down.

A score is an estimate, not a fact. When the team argues over a 3 or a 4, reduce the uncertainty instead: look for the cheapest piece of evidence that would change the decision: check the asset inventory, run a scan, read the vendor advisory, look up the EPSS score. Give ranges when you are unsure (“between 5% and 20% a year”), and stop measuring once more data would not change what you do.