Seven Cyber Risk Assessment Mistakes That Give Security Leaders False Confidence

Key points

• Treating a cyber risk assessment as a checklist rather than a decision-making tool is the single most common failure security leaders describe.
• Every major breach in the past decade involved an organisation that was compliant with security rules at the moment it was broken into, according to Adriel Desautels, CEO of penetration-testing firm Netragard.
• AI tools connected to internal company systems are routinely missing from risk assessments, leaving a growing blind spot that no one officially owns.
• A completed risk register, the document listing known risks and their ratings, can create false confidence at board level when its underlying assumptions are never revisited.
• Security experts interviewed by CSO Online agree that risk must be measured in business harm, not just technical findings.

A cyber risk assessment is supposed to answer one question: if something goes wrong, how badly does it hurt the business? Done well, it tells security leaders where to spend limited time and money. Done badly, it produces a tidy document that satisfies auditors and misleads everyone else.

Seven security experts described the patterns they see most often. The picture is not flattering.

The checkbox trap

The most common failure is treating the assessment as a fixed list to complete rather than a conversation about real danger. Shirsendu Mondal, a cybersecurity researcher at the University of North Carolina, puts it plainly: when security teams focus on ticking items off, they stop asking whether those items reflect how the organisation could actually be hurt.

His fix is simple in principle. Ask where each important system lives, who can reach it, what data it holds, and what breaks if it goes offline. Tie every finding to a business consequence.

Skipping the awkward corners

Denis Calderone, CTO at Suzu Labs, sees a version of this constantly. The assessment covers the main servers and the corporate network. It quietly ignores the old development machine in the corner, the supplier portal that nobody internally owns, and the software interface, called an API (a connection that lets two computer systems talk to each other), that a project team switched on two years ago and never switched off.

"Attackers don't care about your scoping decisions," Calderone says. "They look at the whole environment."

AI tools make this worse. Organisations are connecting AI assistants to internal databases and granting them account credentials, which are usernames and passwords that let software act on a user's behalf, and none of this appears in most assessments. If your assessment pre-dates your organisation's AI rollout, Calderone warns, it is already out of date.

Does a green dashboard mean you are actually safe?

No. Amit Basu, CIO and CISO at International Seaways, says executives see a completed risk register and assume the organisation is protected. Real threats go unaddressed because they did not fit the framework. "The gotcha does not announce itself," he says. "It hides inside a green dashboard."

Compliance is not security

Every major breach in the past decade, Desautels notes, hit an organisation that was compliant at the time. Compliance sets a floor. It does not build a ceiling. Organisations that mistake one for the other end up with what he calls a paper seatbelt: it looks reassuring until the crash.

What ordinary people should watch for

If you are a customer, patient, or employee of any large organisation, you cannot audit their risk assessment yourself. What you can do: watch for unexpected emails asking you to confirm account details (a sign that criminal access may already exist), treat any message creating urgency as suspicious, and use a different password for every service you log into. A password manager makes this easy.

The broader lesson from these seven experts is that a risk assessment is a living conversation, not a filing exercise. The moment it becomes a document written once and stored, it starts lying.