Is your risk management one-sided, designed to minimise the likelihood and negative impacts of uncertain events. How is the uncertainty of events with positive business impacts managed? Not by the security team or using the same risk management framework, right?

Threats and opportunities both rely on uncertainty. Add factors including likelihood (or frequency) and impact to either and you derive a risk. A risk that can be influenced by actions you take and external factors you don't control. While some terminology will likely need to be revised (for example we don't want to mitigate upside risks, we want to promote them) can we not manage all risk using the same framework?

In this episode we talk about Balanced Risk. A holistic view on risk and risk management. One that considers both threats and opportunities, with risk treatment driven by business goals and tempered by risk appetites. Risk treatments that are rarely simple and may affect multiple risks and themselves introduce new risks. Reimagine risk management not as minimising (downside) risk, but as gaining confidence in achieving business goals.