Risks are unwanted events that affect our assets. These events are caused by threats that exploit vulnerabilities to impact assets. This generally includes damages the organisation wants to prevent, but can also opportunity costs (missing out on potential gains) can be formulated and treated as a risk.

Read: A risk is a threat to an asset that makes use of a specific type of vulnerability the asset has (or might have).