SECAI Core · phase 8 of 15
Risk
Likelihood and impact (or consequence) of a threat actor exercising a vulnerability.
The Explain card
- Plain English
- Risk is the combination of how likely it is that a threat actor exploits a vulnerability and how bad the consequences would be if they did. Likelihood times impact.
- Example
- An internal AI assistant reaches HR documents through retrieval. The vulnerability is prompt injection via uploaded files. Likelihood is moderate because staff upload external documents daily; impact is high because salaries and disciplinary records could leak. That combination makes it a high risk worth fixing first.
- Why it matters
- Defenders cannot fix everything. Scoring risk lets you spend limited time and budget on the exposures that actually matter, and explain the choice to leadership.
- Hook
- Risk equals how likely, times how much it hurts.
Where it sits in the deck
Phase 8: Governance, Risk, and Compliance Frameworks
Individual controls need a governance envelope — introduce the risk and compliance structures, standards bodies, and regulations that frame AI accountability at scale.
