TechKnowSurge
CompTIA Security+ 5.2
TechKnowSurge Catalog Interactives Score It on the Risk Matrix
InteractiveSecurityFree

Score It on the Risk Matrix

Likely and major, unlikely and severe: score each risk on a 5 × 5 matrix, band it, and compare.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

Qualitative risk analysis rates a risk instead of pricing it. The Qualitative Risk Analysis lesson uses two five-point scales. Likelihood: 1 rare, 2 unlikely, 3 possible, 4 likely, 5 certain. Impact: 1 negligible, 2 minor, 3 moderate, 4 major, 5 severe. The trouble with two ratings is comparing risks: is an unlikely but major risk worse than a likely but minor one? A risk matrix answers that by giving every combination a level. This activity uses the scale of the module's Risk Register Builder: the score is likelihood × impact, and 1 to 6 is low 7 to 14 is medium 15 to 25 is high So likely (4) and major (4) scores 16, high. Unlikely (2) and major (4) scores 8, the same as likely (4) and minor (2): the matrix puts both in medium, and you need more information, such as a dollar figure, to split them. Notice that certain does not mean high on its own: certain (5) and negligible (1) is 5, low. Organizations draw their own matrices. Other versions use different bands or add a critical level; the method is the same.

What you'll learn

Aligned to

CompTIA Security+
5.2 Explain elements of the risk management process

Key terms

Risk Matrix
A grid used in qualitative risk analysis that maps likelihood against impact to prioritize risks and determine which require the most urgent attention.
Qualitative Risk Analysis
A risk analysis method that uses descriptive ratings such as low, medium, or high to assess the likelihood and impact of risks without assigning specific monetary values.
Likelihood
A descriptive rating used in qualitative risk analysis to estimate how probable it is that a risk event will occur, typically expressed as low, medium, or high.
Impact
The potential consequence or damage to an organization if a risk event occurs, expressed qualitatively or as a monetary value.
Risk Score
A calculated value derived from multiplying or combining probability and impact ratings to quantify the overall level of a risk.

Topics

Risk Analysis Risk Assessment Interactive Calculation

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →