How is risk defined and quantified in information security?
Risk = likelihood × impact — a future, negative deviation from the desired state, weighted by how probable it is.
* Risk = Frequency x Impact — the product grows toward the red top-right corner, where mitigation effort should concentrate. *
Formally, a risk (in the narrow sense = a Gefahr) is a possible future event, rated by its probability and its impact, that would harm the organisation.
$$\text{Risk} = \text{Probability} \times \text{Impact (Schadensausmass)}$$
Because true probabilities are extremely hard to compute, practitioners substitute an estimated frequency (how often per period):
$$\text{Risk} = \text{Frequency of occurrence} \times \text{Impact}$$
Why frequency instead of probability: you rarely know the exact 0–1 probability of a breach, but you can estimate "about twice a year" from incident history and expert judgement. Frequency is measurable; abstract probability usually isn't.
Tip: This is the foundation of the risk matrix — frequency on one axis, impact on the other; the product (top-right corner) is where you focus mitigation.
Go deeper:
Risk matrix (Wikipedia) — the likelihood-vs-consequence matrix and the risk = probability x severity product, plus its resolution limits.- IT risk (Wikipedia) — expands risk into asset / threat / vulnerability / impact — the deeper IT-specific formalisation.