Cybersecurity Risk Assessments: Uncovering and Mitigating Risk

Ross Filipek
October 10, 2023
cyber security in banking, Cybersecurity, Government IT Services

Last updated August 27, 2025.

Cybersecurity risk assessments are essential in today’s threat landscape. But it’s challenging to assess risk, particularly if you don’t have cyber security managed services. Without that expertise, it’s tough to know where to start.

Here’s everything you need to know about cybersecurity risk assessments.

Key points:

Cybersecurity risk assessments help you define an acceptable level of risk.
Risk assessments also provide a clear plan for mitigating risks.
CIS RAM is the leading framework for risk assessment, and it's what we use here at Corsica Technologies.
If it's 12+ months since your last risk assessment, you should consider getting another assessment.

1. What is a cybersecurity risk assessment?

A cybersecurity risk assessment is the process of identifying, evaluating, and prioritizing potential threats to an organization’s digital assets. It involves analyzing vulnerabilities, the likelihood of exploitation, and the potential impact of security breaches. The goal is to inform leadership on risk mitigation strategies. This helps ensure data integrity, confidentiality, and system availability.

Frameworks like NIST 800-171, ISO 27001:2013, and CIS RAM all offer robust protocols for identifying and quantifying risks, but many organizations encounter a unique challenge here. Traditional gap assessments can make it appear that the organization must mitigate all risks completely. This is often impossible due to 1) limited resources, and 2) the excessive friction that this would introduce to business processes.

Clearly, businesses need practical methods of assessing and mitigating cybersecurity risk. Ideally, these methods would define and allow acceptable risk while providing sufficient security. They should do so without forcing the organization to over-invest—and without creating extreme roadblocks for business processes.

That’s the thinking behind CIS RAM, the Risk Assessment Method jointly developed by CIS (Center for Internet Security) and HALOCK Security Labs. It’s an excellent methodology for assessing cybersecurity risk, and it’s what we recommend here at Corsica Technologies.

“The internet is a bit of wild, wild west. Corsica serves as our eyes on cybersecurity and ensures our staff are educated.”

—Sharon Pohly, CEO | Girl Scouts of Northern Indiana-Michiana

See case study →

2. What are the benefits of a cybersecurity risk assessment?

Cybersecurity risk assessments provide numerous benefits, such as enterprise-level knowledge of risk, a methodology for defining acceptable risk, and a plan for mitigating risk.

Here’s what each of these looks like in detail.

Enterprise-level knowledge of risk

Small businesses typically can’t afford to hire cybersecurity experts on staff. This puts them at a significant disadvantage in comparison to enterprises.

You might think a large company is more likely to be a target. Unfortunately, it’s exactly the opposite. Enterprise-class organizations have hardened their systems so well that cyber criminals are turning to softer targets. That means local manufacturers, regional banks, medical practices, county governments—even local schools.

Every organization needs enterprise-level knowledge of their cybersecurity risks. An assessment from experts provides deep insight that a smaller organization can’t get any other way.

A methodology for defining the threshold of acceptable risk

100% bulletproof security is actually impossible to attain. You don’t know what you don’t know about evolving cyberthreats. Even if it was possible, SMBs would struggle to allocate resources to maintain this security. They would also experience prohibitive friction in their daily operations.

A cybersecurity assessment provides a rubric for defining the threshold of acceptable risk. To do so, it provides a framework for quantifying risk, which makes it easier to communicate both findings and mitigation plans to stakeholders.

A clear plan for mitigating risks to acceptable levels

Since a cybersecurity assessment measures risk against a well-defined threshold of acceptability, it also helps give structure to plans for mitigating risks to acceptable levels. It really isn’t possible to do this without an assessment, since the assessment process determines both the threshold of acceptable risk and the actual quantified risk in any particular area.

A clear plan for implementing “just enough” security

Not enough security, and an organization maintains unacceptable levels of risk.

Too much security, and the organization can’t function due to the friction introduced by excessive measures.

The key, then, is to implement “just enough” security—which a risk assessment helps define. This prevents the organization from spending too much on cybersecurity or introducing too much friction to their operations.

3. What are the dangers of not assessing cyber risks?

There are numerous dangers associated with lack of visibility into cybersecurity risks. Sensitive data leaks through AI tools, phishing emails, weak passwords, and unpatched systems are just a few of these risks.

Here are all the details.

Sensitive information can leak out in a ChatGPT prompt

Believe it or not, ChatGPT is a cybersecurity risk.

Anything entered in a verbal prompt can be used to train the AI further. This means it can also leak out in the AI’s output.

This is why we recommend Microsoft Copilot rather than ChatGPT. Copilot works within your Microsoft 365 environment and rigorously protects your data (and anything entered in prompts). Read more here: Microsoft Copilot vs. ChatGPT.

Phishing emails can trick untrained employees

A phishing email is one that comes from a rogue actor while appearing to be legitimate. Phishers use techniques of social engineering to create a sense of urgency and panic—so the employee reacts and clicks a link (or downloads an attachment) before thinking critically.

For example, a phishing email might claim to be from HR, saying you need to click a link to enter banking details, or you won’t get paid.

Whatever the strategy, phishing emails are incredibly dangerous.

But they also have telltale signs that employees can learn to recognize. Things like strange “from” addresses and odd URLs linked in buttons are dead ringers.

A cybersecurity risk assessment can help you uncover weaknesses in email security, as well as gaps in employee awareness. It’s the first step in mitigating the ever-present threat of phishing emails.

Weak passwords make it easy for hackers to get in

For legacy organizations, passwords can represent a massive liability. The older the system, the more likely it is to have a highly unsecured password and no MFA (multi-factor authentication).

How real is this threat? Consider the top 5 most common passwords in 2022, according to NordPass:

password
123456
123456789
guest
qwerty

Even if an employee isn’t using such dangerous passwords, they may have one password that they use across all systems. Your organization may even have a single password that many employees use to access many different systems.

All it takes is a single breach for hackers to install ransomware or malware. Consider that the average ransomware demand hit $4.74 million in 2022 ($13.2 million for businesses). Clearly, weak passwords are one of the greatest dangers any organization faces.

Luckily, a cybersecurity risk assessment will uncover just how much risk you face here—and how you can mitigate it without making operations impossible.

Unpatched systems create serious vulnerabilities

This is a significant liability for legacy organizations using on-premises servers. However, even companies with cloud-based services can fall prey to missed patches if they don’t have an MSP (managed services provider) or MSSP (managed security services provider) who’s responsible for all patches.

If your team doesn’t patch a vulnerability, hackers can easily install malware on the unsecured system. This can empower them to exfiltrate data, direct website users to malicious IPs, and more.

A cybersecurity risk assessment can uncover the unpatched systems you didn’t know about. It’s crucial to preventing this type of attack.

4. How do you get the most out of a risk assessment?

Not all cybersecurity risk assessments are created equal. Some vendors will provide only the assessment findings, with no recommended action plan to mitigate risks.

This may work for your organization if you have a dedicated cyber team. However, most organizations need a plan for mitigating risks in addition to the assessment.

This is why most companies should look for comprehensive assessments. Make sure you ask for recommendations and an action plan in addition to the assessment itself.

Hint: That’s what we offer here at Corsica Technologies.

5. What is the process of cybersecurity risk assessment?

Here at Corsica Technologies, we use CIS RAM to conduct cybersecurity risk assessments. Here’s what the process typically looks like.

Develop criteria for both risk assessment and risk acceptance.
Model risks by evaluating the existing implementation of the relevant CIS Safeguards.
Evaluate risks. Estimate the expectancy and impact of a breach to arrive at a quantified score for each risk.
Propose implementation of CIS Safeguards that will reduce unacceptable risks.
Analyze the proposed CIS Safeguards to make sure they will reduce risk to acceptable levels without introducing unacceptable friction to operations.

Risks may be modeled differently depending on how advanced your existing controls are. The sophistication of your existing controls is defined by CIS’s Critical Security Controls Implementation Groups, and CIS provides specific guidance on how to model risks for each implementation group (IG) which they define. A qualified cybersecurity risk assessor will determine your IG, and thus how your risks should be modeled.

6. What are the deliverables of a risk assessment?

Here are the deliverables you receive from a comprehensive risk assessment with Corsica Technologies:

Report evaluating your current cyber risks against the relevant standards
In-depth analysis of the report
In-depth consultation regarding our findings with our CISO, Ross Filipek
Detailed plan of recommended mitigation strategies based on our findings

As we mentioned above, not every company provides a comprehensive risk assessment—i.e., one that goes beyond a mere description of the problem and provides a plan for mitigation. When working with Corsica, you don’t only get the results of our assessment. You get our recommendations, too.

The Corsica Difference »

You Won’t Find Our Value Anywhere Else:

Achieve outcomes that matter »

Consulting Services

AI Transformation

Industries Served

Your Business, Your Vertical:

Insights and Resources

Guides + Education:

Tools and Templates: