Which activity best describes risk prioritization in cybersecurity?

• A. Implementing mitigations without considering likelihood
• B. Systematic process to identify, estimate, and prioritize risks
• C. Focusing only on compliance checklists
• D. Ignoring low-probability threats

Answer: (B)

Risk prioritization in cybersecurity is a structured, ongoing process that identifies threats and vulnerabilities, estimates how likely each risk is and how severe its impact would be, and then ranks them so resources go to the most significant risks first. This approach ensures decisions are driven by a reasoned assessment of where a breach would cause the most harm and how likely that harm is, rather than by gut feeling or a checkbox.

The best description reflects that systematic approach to identifying, estimating, and prioritizing risks, enabling effective allocation of mitigations to the highest-risk areas. Implementing mitigations without considering likelihood treats all risks the same and can misallocate resources. Focusing only on compliance checklists reduces security to ticking boxes rather than addressing actual risk scenarios. Ignoring low-probability threats isn’t aligned with a risk-based mindset, since even unlikely events can have meaningful impact and should be weighed appropriately in the prioritization process.