Name the Risk Element — TechKnowSurge

About this interactive

The Risk Management lesson builds one picture of risk out of five parts. The asset is anything with value to the company: money, data, code, the brand, even the people who work there. Risk management is about protecting assets. A threat is something that could happen to the asset. Data could be stolen (a loss of confidentiality), altered (a loss of integrity), or deleted or knocked offline (a loss of availability). The threat actor, or threat agent, is whoever carries the threat out: one person, a group or an organization. A vulnerability is a weakness, like the break in the gate in the lesson's picture. When the actor uses that weakness, that is an exploit, and if it works, the result is a breach. A control is a step put in place to reduce the risk. Risk is probability times impact, so a control lowers one or the other: a wall and a gate lower the probability of theft, and deleting data you no longer need lowers the impact if it is stolen. A quick test for each card: is it the thing of value, what could happen, who would do it, the weakness, or the fix?

What you'll learn

Name each part of a risk scenario: the asset at stake, the threat to it, the threat actor who carries it out, the vulnerability that lets it happen, and the control that reduces it
Tell a threat (what could happen to the asset) from the threat actor (who makes it happen)
Recognize a control as a step that lowers either the probability of a threat or its impact

Aligned to

CompTIA Security+

5.2 Explain elements of the risk management process.

Key terms

Asset: Any resource of value to an organization, including hardware, software, data, and personnel.
Threat: Any potential event or action that could cause harm to a system, network, or organization.
Threat Actor: An individual or group responsible for a security incident or attack.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.
Security Control: Any safeguard or countermeasure — whether technical, physical, or administrative — implemented to protect the confidentiality, integrity, and availability of systems and data. Security controls are classified by function (preventative, detective, corrective) and type (technical, physical, administrative).
Risk: The potential for loss or harm resulting from a threat exploiting a vulnerability.

Topics

Risk Management Threats Vulnerabilities Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →