A basic cyber risk matrix

Cyber risk comes in various shapes and sizes.

What it looks like influences how you prepare.

1. Likely and high impact: Fix this now. Deploy changes and hunt down threats.
2. Likely and low impact: Focus on prevention. Manage risks, inventory assets, and model threats. You want to be systematic.
3. Unlikely and high impact: Focus on recovery. Have a contingency plan, build redundant systems, and train people. You want to be ready.
4. Unlikely and low impact: Follow best practices. Stay vigilant. Remember that small things add up.

You control likelihood by making sure it doesn't happen. And you control impact by being ready to adapt.