security risk

A measure of potential harm to an organization's information assets, operations, individuals, or mission — jointly determined by the likelihood that a threat will exploit a vulnerability and the severity of the resulting adverse impact. Per the NIST CSRC Glossary, drawing from NIST SP 800-160v1r1 and ISO Guide 73, it is formally defined as "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences." In information-system contexts, NIST elaborates this as risk arising through loss of confidentiality, integrity, or availability of information or systems, considering impacts to organizational operations and assets, individuals, other organizations, and the Nation. The field uses the expression operationally as an assessable and manageable quantity: risk is the potential for harm when a threat exploits a vulnerability, expressed as a function of threat source, threat event, vulnerability, predisposing conditions, and impact, and practitioners apply it at every tier — from individual systems to enterprise missions — to prioritize controls, justify countermeasures, and drive risk-treatment decisions.