16.1 Asset, Threat, Vulnerability, and Impact Basics
The Risk Equation, Term by Term
Risk is commonly expressed as Risk = Asset Value x Threat Level x Vulnerability Severity. The multiplication is deliberate: risk collapses toward zero if any factor is zero. A priceless asset with no interested adversary is not a risk you fund; a enthusiastic attacker facing a fully patched, air-gapped asset is likewise not one. Asset value means the harm of losing confidentiality, integrity, or availability -- not purchase price. Threat level captures who wants the asset, their capability, and their frequency of trying. Vulnerability severity captures how easy the asset is to attack: unpatched services, weak credentials, missing backups, or an unlocked door.
Qualitative Before Quantitative
Two scoring styles exist. Qualitative risk uses ordinal labels -- low, medium, high, or 1-5 scales -- driven by expert judgment and simple likelihood-by-impact grids; it is fast, cheap, and good enough for most beginners. Quantitative risk replaces the labels with numbers: probable loss in currency and expected events per year. Quantitative scores look precise but inherit the guesswork from their inputs, so a sensible workflow is qualitative triage first, quantitative math only for the handful of high rows where a costly decision actually hinges on the number.
Impact Is the End of the Chain
Trace every risk along a path: threat actor exploits a vulnerability to compromise an asset, producing impact -- data exposed, service down, integrity corrupted, fines, or reputational damage that shows up as churn. Impact, not the vulnerability, is what you budget against: a critical CVE on a throwaway test box has low impact, while a medium flaw on the only copy of your customer database can be existential. This is why beginners should list assets first, then ask what breaks them and what that breakage actually costs.
Architecture Diagram
Key Takeaways
- Risk = Asset Value x Threat x Vulnerability; if any factor is zero, the risk is effectively zero.
- Asset value is the cost of losing confidentiality, integrity, or availability, not the sticker price.
- Start qualitative with 1-5 likelihood and impact grids; go quantitative only where a costly decision depends on it.
- Every risk should be written as a path: actor, vulnerability, asset, impact.
- Budget against impact, not against a raw vulnerability severity label.