Risk Assessment

Rate each risk with Probability and Impact. Use the sliders to capture your current view; add context later if needed.
Organization
1. Technical Risks
1. Malware (viruses, worms, Trojans, spyware, ransomware)
2. Denial-of-Service (DoS) & Distributed Denial-of-Service (DDoS) Attacks
3. Zero-Day Exploits
4. Cross-Site Scripting (XSS)
5. Session Hijacking
6. API Abuse & Exploits
7. Drive-by Downloads
8. Advanced Persistent Threats (APTs)
9. Unauthorized Access to Sensitive Data
10. Insider Threats (Malicious & Accidental)
11. Exposure of Personally Identifiable Information (PII)
12. Shadow IT Risks (Unapproved Apps/Services)
13. Weak encryption & poor key management
14. Database Misconfigurations
15. Artificial Intelligence (AI)-Driven Attacks
16. Deepfake & Voice Impersonation Scams
17. Quantum Computing Risks (Breaking Cryptography)
18. Synthetic Identity Fraud
19. Exploitation of Authentication Systems
20. Weak or Reused Passwords
21. Insufficient Multi-Factor Authentication (MFA)
22. Overprivileged Accounts
23. Expired or Orphaned Accounts
24. Social Engineering Exploits on IAM Systems
25. Insecure API Keys & Tokens
26. Poor Identity Federation Security
27. Unsecured Wi-Fi Networks
28. Open Ports & Services
29. Inadequate Firewall Configurations
30. Rogue Devices & Unauthorized Access Points
31. Lack of Network Segmentation
32. Use of Default Credentials in Network Devices
33. Unpatched Routers & Switches
34. Outdated or Unpatched Software
35. BYOD (Bring Your Own Device) Security Risks
36. Lack of Endpoint Detection & Response (EDR)
37. Infected Removable Media (USBs, External Drives)
38. Unprotected IoT Devices
39. Jailbroken or Rooted Mobile Devices
40. Stolen or Lost Devices with Sensitive Data
41. Misconfigured Cloud Storage (e.g., S3 Buckets)
42. Insecure API Calls
43. Unsecured SaaS Applications
44. Poor or Lack of Identity Management
45. Lack of Security Information and Event Monitoring (SIEM)
46. Vendor Lock-in & Security Dependence
47. Shared Responsibility Model Misunderstanding
48. Unauthorized Physical Access to Data Centers or Offices
49. Unattended Devices (Laptops, USBs, Printed Docs)
50. Dumpster Diving (Sensitive Information Disposal Issues)
51. Lack of Surveillance & Intrusion Detection
52. Theft or Tampering with Hardware
53. Hardware Implants & Keyloggers
54. Shoulder Surfing & Unauthorized Screen Viewing
55. Unsecure API Integrations with Third-Party Services
56. Software Supply Chain Risks and Attacks
57. Lack of Vendor Risk Management
58. Outsourcing Security Weaknesses
59. Poor DevOp Practices Including Lack of Proper Source Code Controls
2. Compliance & Legal Risks
60. Non-Compliance with Regulations (GDPR, HIPAA, PCI-DSS, etc.)
61. Failure to Meet Industry Security Standards (ISO 27001, NIST, CIS, etc.)
62. Legal Repercussions from Data Breaches
63. Lack of Cyber Insurance or Coverage Gaps
64. Failure to Retain or Delete Data as Required by Law
65. Improper or Lack of Data Classification Controls Leading to Exposure or Loss of Sensitive Data
3. Human & Behavioral Risks
66. Lack of Security Awareness Training
67. Shadow IT Usage (Employees Using Unapproved Apps)
68. Over-Reliance on IT Without Understanding Risks
69. Insufficient Incident Response Readiness
70. Poor Crisis Communication & Response
71. Unreported Security Incidents
72. Lack of Document and Change Management
73. Lack of Formalized Security Policies and/or Poor Policy Communication to Employees and Contractors
74. Improperly Defined Security Roles and Responsibilities / Lack of Executive Support and Sponsorship
75. Insufficient Knowledge and Awareness of Emerging and Current Cyber Threats by Security Operations Staff
76. Lack of Affiliation with Professional Cyber Security Associations and Local Authorities by Security Operations Staff
77. Lack of Security Based Documentation / Work Instructions Accessible by Staff Performing Security Related Functions
78. Insufficient Hiring Practices, Ineffective Performance Evaluations Leading to Poorly Qualified Information Security Operations Staff Including High Turnover Rates
79. Lack of Formalized Disciplinary Action Plans for Employees Who Fail to Comply with Corporate Security Policies
80. Lack of Formalized Offboarding Plan for Terminated Employees Creating Potential Data Loss Risk
81. Failure to Protect Confidential Corporate Information During Introduction of New Security Technologies
82. Failure to Mitigate Risks Associated with Remote Access/Connectivity
83. Inadequate Access Controls to Corporate Information
84. Improper Management of Administrative Privileges
85. No Standardized Method for Introduction of New Software Applications and Platforms
86. Network Architectures That Are Not Secure by Design
4. Business Continuity & Disaster Recovery Risks
87. Lack of a Proper Incident Response Plan
88. Insufficient Backup & Recovery Strategy
89. Failure to Test Disaster Recovery Procedures
90. Single Point of Failure in Infrastructure
91. Ransomware-Induced Downtime
92. Inadequate Cybersecurity Budget & Investment
93. Role based access control compromise
94. Failure to Integrate Security Protocols, Standards and Best Practices into All IT Related Tasks and Projects
95. Insufficient or Lack of Asset Management Platforms, Tools and Documentation
96. Lack of Controls & Policies For Data Access and Secure Sharing of Information
97. Data Center Environmental Issues and Lack of Secure Workspace Practices and Policies
98. Poor Capacity Planning and Management
99. No External Validation / Audit to Independently Verify Effectiveness of Information Security Practices