TechKnowSurge
CompTIA Security+ 5.2
TechKnowSurge Catalog Interactives Inherent or Residual?
InteractiveSecurityFree

Inherent or Residual?

The risk as first found, or what is left after the fix? Sort each risk, one at a time.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

When we mitigate a risk, it usually does not go away completely. The Inherent and Residual Risk lesson gives the two names. Inherent risk is the risk as it is at first: what risk analysis finds before any plan or control is applied. In the lesson, five risks come out of analysis at $100,000, $10,000, $30,000, $120,000 and $10,000. Mitigation reduces the probability that the event happens, or the impact if it does. The $100,000 risk might come down to $30,000, and a $10,000 risk to $2,000. Residual risk is the risk that continues after mitigation: the $30,000 and the $2,000. A quick test for each card: is this the risk before anything was done about it, or what is still there after the control is in place? Residual risk is what the company is left carrying, so it is what gets compared with the risk threshold, and the drop from inherent to residual is the benefit a control delivers.

What you'll learn

Aligned to

CompTIA Security+
5.2 Explain elements of the risk management process.

Key terms

Inherent Risk
The level of risk that exists before any mitigation controls or countermeasures are applied. Understanding inherent risk helps organizations determine where to prioritize security investments.
Residual Risk
The level of risk that remains after security controls have been applied to reduce inherent risk. No control eliminates risk entirely; residual risk must be formally accepted by management or addressed with additional mitigations.
Risk Mitigation
The process of reducing the probability or potential impact of a risk through the implementation of controls, countermeasures, or process changes. Risk mitigation is one of four standard risk response strategies alongside avoidance, transfer, and acceptance.
Risk
The potential for loss or harm resulting from a threat exploiting a vulnerability.

Topics

Risk Management Risk Analysis Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →