significant security risk

A qualitative judgment, made within a risk assessment or access-governance process, that a particular condition, entity, or configuration raises the probability or potential impact of a security-relevant adverse event to a level that demands a prioritized response — above the threshold of routine or acceptable risk. Information security risk is "measured in terms of a combination of the likelihood of an event and its consequence," and the modifier "significant" maps to the middle-to-upper tiers of that combined scale: determining whether potential impact would be limited, serious, or severe — what NIST formalizes as low, moderate, and high impact levels. In practice, the phrase is used attributively — "users who pose a significant security risk," "vulnerabilities that pose a significant security risk" — to flag subjects that require elevated controls, accelerated remediation, or special authorization review, by identifying the most critical assets and ensuring the most significant risks are adequately addressed.

Advisory only. A term this product ships is defined by an authority document, not by a search result.