What is cyber risk?
Cyber risk is the chance that a cyber-related event could harm the business, such as financial loss, downtime, data exposure, or reputational damage.
Simple example
A business relies heavily on email for payments, so account compromise creates a high fraud risk.
Why it matters
Risk helps businesses decide where to spend time and money first.
Common warning signs
- The activity is unexpected or unusual for the business context.
- The request or system behaviour creates pressure to act quickly.
- Normal approval, verification, or security processes are bypassed.
- There are signs of unauthorised access, data exposure, or system change.
- Staff are unsure whether the request, message, or system behaviour is legitimate.
Cyber Doc view
This term should be understood in business context, not only as a technical issue. Good protection usually combines clear processes, appropriate technical controls, staff awareness, and a calm response plan.
What to do
Proactive steps
- Identify critical systems and data.
- Understand likely threats to the business.
- Prioritise controls that reduce the biggest risks.
- Review risk after business or technology changes.
- Document decisions and owners.
Reactive steps
- Assess what was affected and how serious it is.
- Prioritise recovery based on business impact.
- Record decisions and timelines.
- Notify relevant stakeholders if required.
- Update the risk register after the event.
Related terms
- Threat
- Vulnerability
- Maturity assessment