For years, cyber risk lived in a room of its own. The IT department managed it, in its own language, with its own tools, reporting to its own dashboards. The rest of the risk register — suppliers, finance, people, strategy — lived elsewhere, managed by different people who found the cyber room slightly intimidating.
This separation was always artificial, and today it's actively dangerous. A ransomware attack is not an IT event that inconveniences the business; it is a business event — halted production, silent phones, contractual penalties, a board meeting nobody enjoys — that happens to arrive through IT. The organizations handling cyber risk best have stopped treating it as a specialty and started running it through the same process as every other threat to their objectives: identify, analyze on the same matrix, treat, monitor, review.
Here's how that looks in practice.
Naming the risk properly
The first casualty of the old separation was language. "Cyber risk" appeared in registers as a single line — unanalyzable, unownable, untreatable. You cannot rate "cyber" on a 5×5 matrix any more than you can rate "weather."
The fix is the same cause-event-consequence discipline used everywhere else in the register. Not "cyber risk" but: "Because employees can be deceived by increasingly convincing phishing emails, an attacker may obtain admin credentials, leading to encrypted systems and a multi-day production outage." Or: "Because our customer portal depends on a single cloud region, a provider outage may make ordering impossible for hours, leading to lost sales and SLA penalties."
Written this way, digital risks become ordinary register citizens: assessable, comparable against non-digital risks, and treatable with the standard four strategies. The typical short list for most organizations includes phishing and social engineering, ransomware, cloud service outages, misconfigured cloud resources exposing data, unpatched known vulnerabilities, over-broad access rights, shadow IT (services adopted by teams without review), and dependency on a handful of critical digital suppliers.
The assessment: same matrix, two honest inputs
Cyber risks go on the same 5×5 matrix as everything else — that's the point, since it forces the comparison ("is ransomware a bigger risk to us than losing our key account manager?") that budget decisions actually require. Two assessment habits matter specially here.
Likelihood: use the outside view. Optimism bias is nowhere stronger than in cyber. "We're not an interesting target" fails against the reality that most attacks are opportunistic and automated — the scanner doesn't check your brand awareness before probing your firewall. Phishing attempts are near-certainties (likelihood 5) for any organization with email; the question is only whether one succeeds. Anchor likelihood on industry base rates and your own incident and near-miss logs, not on self-image.
Impact: follow the business consequence. The impact of a cyber event isn't measured in servers but in the same dimensions as every other risk: money, downtime, reputation, legal exposure. The useful question in the workshop is not "what happens to the system?" but "what stops happening in the business — and for how long?" This is also where non-IT people become essential assessors: only sales knows what a day of portal outage costs; only production knows how long it can run without the ERP.
Treatment: the classic four, digitally translated
The four treatment strategies apply without modification.
Avoid: don't collect data you don't need (data you don't hold can't leak), retire the legacy system, decline the integration whose vendor can't answer basic security questions. Data minimization is avoidance in its purest form and remains the most underrated security control in existence.
Reduce: the bulk of cyber treatment. On the likelihood side — patching discipline, multi-factor authentication, least-privilege access, email filtering, awareness training, secure configuration baselines for cloud resources. On the impact side — offline backups tested by actually restoring them, network segmentation so one compromised laptop doesn't become a compromised company, an incident response plan that's been rehearsed, not just written. As always, pair the two sides: prevention fails eventually, and mitigation unused is untested.
Transfer: cyber insurance and contractual clauses with providers. Genuinely useful for the financial tail — and genuinely limited. The policy pays for forensics and recovery; it does not restore customer trust or un-publish leaked data. Read the exclusions before the incident: many policies demand evidence of baseline controls (MFA, backups, patching), which conveniently are the things you should do anyway.
Accept: legitimate for the long tail of minor digital risks — documented, owned, and reviewed, like any other acceptance. What must never be accepted silently is the red corner: the unpatched internet-facing system "we'll get to next quarter" is an undocumented acceptance of a top-tier risk, made by default rather than by decision.
Monitoring: cyber's home advantage
Here's the pleasant surprise: cyber risks are among the easiest to monitor, because digital environments generate their own telemetry. Where supplier risk or key-person risk requires deliberately constructed indicators, cyber KRIs often fall out of systems you already run: share of systems with critical patches overdue, phishing-simulation click rate, number of accounts with admin privileges, backup jobs failed this month, findings open past their remediation deadline, unknown services discovered on the network.
Wire the thresholds into your standard review rhythm — amber means the risk owner investigates, red means escalation — and cyber stops being the register's black box and becomes its best-instrumented section. Add the incident feedback loop (every incident and near-miss checked against the register: was it in there? were the ratings right? did controls hold?) and you have a self-correcting system.
The governance point that makes it stick
One final translation from IT language to management language, and it's the important one: cyber risks need business owners, not just technical ones.
The firewall administrator owns a control. The risk — "production halts for days" — belongs to whoever owns production. When digital risks appear on the same matrix, in the same quarterly review, owned by the same leadership team as every other existential threat, two things change: security spending stops being an IT budget mystery and becomes visible risk treatment, and executives stop asking "are we secure?" (unanswerable) and start asking "which of our top risks are digital, and are their treatments on track?" — a question the register answers every quarter.
Cyber risk never needed its own room. It needed a seat at the table where all the other risks sit — same matrix, same owners' names, same review calendar. Give it that seat, and the most modern threat category turns out to be manageable with the most classical toolkit in the book.