Illustration of a stressed office worker overwhelmed at his desk

Simplifying Security Risk Management: The Power of the Security Risk Triangle

by
with no comment
Security Risk Management

Most security risk assessment methodologies ask the same three questions. They just use different words to ask them.

If you work in physical security risk management, you will know the alphabet soup:

  • SA HB 167:2025, Security Risk Management Handbook
  • API Standard 780 (Second Edition), Security Risk Assessment Methodology
  • The Adversarial Risk Management (ARM) methodology
  • ASIS SRA-2024, Security Risk Assessment Standard
  • SRMBOK, the Security Risk Management Body of Knowledge
  • ISO 31000:2018, Risk Management Guidelines

So which one should you use? When I raise security risk assessment with clients, the reaction is often a mix of confusion and frustration, and an understandable wish to be doing almost anything else.

Yet risk assessment is the foundation of every security management system. Every standard above says so. It is also increasingly a legal requirement, not just good practice. The SEC’s cybersecurity rules in the US, and the NIS2 and CER Directives in the EU, all require organisations to carry out comprehensive, ongoing risk assessments.

That is where the security risk triangle comes in.

What is the security risk triangle?

The security risk triangle is a simple way to cut through the noise. It reduces every security risk assessment to three questions, and it works for physical and cyber security alike:

  1. What are you trying to protect? (Assets)
  2. What are you trying to protect it from? (Threats)
  3. How vulnerable is it? (Control effectiveness)

Remove any side and the triangle collapses. Focus on threats without linking them to your critical assets, and you are analysing in a vacuum. Put controls in place without matching them to real threats, and you are spending money on guesswork. Skip the assets altogether, and you have to ask what exactly you are protecting.

Three questions. That is the starting point for every methodology on the list.

How the security risk triangle aligns with the major standards

What are you protecting? (Assets)

  • ARM methodology: “Asset identification is all about knowing yourself better than the adversary knows you.”
  • API 780: designed to assess a broad range of assets and operations.
  • ASIS SRA-2024: centres on identifying the threats to those assets.
  • ISO 31000: treats asset identification and valuation as foundational steps.
  • SRMBOK: recognises asset identification as critical to protecting valuable resources.

What are you protecting it from? (Threats)

  • ARM methodology: focuses on understanding the adversary’s objectives.
  • API 780: identifies potential adversaries and the impact they could have.
  • ASIS SRA-2024: prioritises a thorough threat assessment.
  • ISO 31000: includes threat assessment within risk identification.
  • SRMBOK: emphasises the need for detailed threat assessment.

How vulnerable is it? (Control effectiveness)

  • ARM methodology: selects controls for their effectiveness against the threats identified.
  • API 780: uses vulnerability assessment to inform the choice of countermeasures.
  • ASIS SRA-2024: stresses evaluating whether security controls actually work.
  • ISO 31000: encourages ongoing review of control effectiveness.

Converged security risk assessment is no longer optional

The UK’s Level 4 Protective Security Apprenticeship requires converged security risk assessments, covering both physical and cyber domains. The updated SA HB 167:2025 moves the same way, widening its scope to security-related risk across physical, cyber, people and information.

The direction is clear. Converged security is where the profession is heading, and the security risk triangle works the same way whichever domain you start from.

Where security risk management meets enterprise risk management

Security risk management (SRM) focuses on protecting the organisation from security threats. Enterprise risk management (ERM) covers every type of risk the business faces, to improve performance and resilience. SRM is a subset of ERM.

That matters, because adopting ISO 31000 for security risk management translates the language of physical and cyber security into terms leadership already understands. Security risks are then evaluated alongside the business risks they sit next to, and the value of the security function becomes much easier to see.

Why the security risk triangle works

Using the security risk triangle as your foundation helps you to:

  • raise the value of the security function, and earn its seat at the boardroom table;
  • lead a converged approach to security risk management, rather than follow one;
  • stay compliant with both organisational and regulatory requirements.

With ISO 31000 as the base framework, you can adapt any security risk methodology to fit your organisation. That is exactly what we did when we built the HawkSight algorithm. We combined ISO 31000 with an adversarial threat analysis approach, drawing on lessons from both the physical and cyber domains. The result is one framework for efficient, converged security risk management, helping teams do more with less.

Whether you sit in the boardroom or manage security risk on the front line, I would like to hear how this lands with you. What is the hardest part of security risk assessment in your organisation, and does the triangle help you explain it?

This article was written with AI assistance.

Comments are closed.