In cybersecurity risk assessment, which two components are typically evaluated?

• A. Probability of threats and financial cost
• B. Potential loss and exposure
• C. Likelihood of threats and impact (severity) of adverse events
• D. Vulnerability level and asset value

Answer: (C)

In cybersecurity risk assessment, risk is assessed as a function of two things: how likely a threat is to occur and how severe the consequences would be if it does. This is why the two components evaluated are the likelihood of threats and the impact (severity) of adverse events. Conceptually, risk is often thought of as likelihood times impact, a framework used in standards like NIST SP 800-30 and ISO 31000. This pairing helps you prioritize controls by focusing on events that are both probable and damaging.

For example, a phishing campaign may be quite likely and cause moderate damage, while a zero-day exploit on a critical system could cause severe damage even if it’s less frequent. Financial cost is one way to express impact, but focusing only on cost ignores other consequences like downtime, data loss, and reputational harm. Conversely, vulnerability level or asset value touches weaknesses or value, but they’re not the two core dimensions used to quantify overall risk.