Which formula best defines risk in information security?

• A. Threat x Vulnerability x Impact
• B. Threat + Vulnerability + Impact
• C. Probability x Impact
• D. Asset Value x Exposure

Answer: (A)

Risk in information security comes from the chance that a threat actor will exploit a vulnerability and the amount of damage that would result. The best way to express that is to multiply the three factors: a threat exists and could exploit a weakness, the vulnerability makes exploitation more likely, and the impact defines how severe the damage would be if it happens. When you multiply them, risk rises with any increase in threat, vulnerability, or impact, and if any one factor is absent (zero), the overall risk is zero.

For example, a system holding highly sensitive data (high impact) with a real threat and a genuine flaw (vulnerability) presents high risk. If there’s a threat and a vulnerability but the impact is low, risk is lower; if there’s vulnerability but no threat, or a threat with no vulnerability, risk is low or zero. This multiplicative view captures how all three elements must align for significant risk to exist.

The other options don’t fit as well because they either add factors together, which doesn’t reflect how risk compounds, or omit essential elements. Some formulas simplify risk to probability times impact, but that leaves out the explicit roles of threat and vulnerability. Asset value with exposure focuses on different concepts and isn’t the standard way to represent risk from exploiting weaknesses.