Seven Cyber Risk Assessment Mistakes That Give Security Leaders False Confidence
Organisations tick boxes, skip awkward corners of their networks, and confuse passing an audit with being secure. Here is what actually goes wrong.
Key points
- Treating a cyber risk assessment as a checklist rather than a decision-making tool is the single most common failure security leaders describe.
- Every major breach in the past decade involved an organisation that was compliant at the moment it was broken into, according to Adriel Desautels, CEO of penetration-testing firm Netragard.
- AI tools connected to internal company systems are routinely missing from risk assessments, leaving a growing blind spot that no one officially owns.
- A completed risk register, the document listing known risks and their ratings, can create false confidence at board level when its underlying assumptions are never revisited.
- Risk must be measured in business harm, not just technical findings.
A cyber risk assessment is supposed to answer one question: how badly does a breach hurt the business? Done well, it tells security leaders where to spend limited time and money. Done badly, it satisfies auditors and misleads everyone else.
Seven security experts described the patterns they see most often. The picture is grim.
The checkbox trap
The most common failure is treating the assessment as a fixed list to complete rather than a conversation about real danger. Shirsendu Mondal, a cybersecurity researcher at the University of North Carolina, puts it plainly: when security teams focus on ticking items off, they stop asking whether those items reflect how the organisation could actually be hurt.
His fix is simple in principle. Ask where each important system lives, who can reach it, what data it holds, and what breaks if it goes offline. Tie every finding to a business consequence.
Skipping the awkward corners
Denis Calderone, CTO at Suzu Labs, sees this constantly. The assessment covers the main servers and the corporate network. It quietly ignores the old development machine in the corner, the supplier portal that nobody internally owns, and the API endpoint, a connection that lets two computer systems talk to each other, that a project team switched on two years ago and never switched off.
"Attackers don't care about your scoping decisions," Calderone says. "They look at the whole environment."
AI tools make this worse. Organisations are connecting AI assistants to internal databases and granting them account credentials (usernames and passwords that let software act on a user's behalf), and none of this appears in most assessments. We noted the same gap in our 4 July story on Five Eyes warnings about AI shrinking attack windows. If your assessment pre-dates your organisation's AI rollout, Calderone warns, it is already stale.
Does a green dashboard mean you are actually safe?
No. Amit Basu, shipping company International Seaways' CIO and CISO, says executives see a completed risk register and assume the organisation is protected. Real threats go unaddressed because they didn't fit the framework. "The gotcha does not announce itself," he says. "It hides inside a green dashboard."
Basu's advice: document the assumptions underneath the assessment explicitly and revisit them whenever the business changes, the threat landscape shifts, or an incident exposes a gap.
Compliance is not security
Every major breach in the past decade, Desautels notes, hit an organisation that was compliant at the time. Compliance sets a floor; it does not build a ceiling. Organisations that mistake one for the other end up with what he calls a paper seatbelt: it looks reassuring until the crash. We made the same argument on 25 June, when FedRAMP 20x forced the question of whether passing audits means anything at all.
Should you worry if you are not a security professional?
You cannot audit another organisation's risk assessment yourself. Watch for unexpected messages asking you to confirm account details, treat any communication manufacturing urgency as suspicious, and use a distinct password for every service you log into. A password manager handles the load.
A risk assessment is a living conversation, not a filing exercise. The moment it becomes a document written once and stored, it starts lying.
