Not Every Risk Deserves the Same Response

Security teams make choices every day.

Some risks can shut down the business, expose critical data, or create a path into core systems. Those need attention now.

Others are basic security hygiene. They need to get done consistently without consuming the organization.

Knowing which is which is one of the most important skills in security.

Start With Intolerable Risk

Every organization has risks it simply cannot carry.

A privileged account without strong authentication may be one. An exposed production system with a known exploitable vulnerability may be another. A vendor with broad access and no clear controls may belong on the list.

The exact list depends on the business.

It should also be short enough that people understand it.

When an intolerable risk appears, the response should be clear. Ownership is established quickly, resources become available, and the exposure gets addressed.

That clarity helps people make decisions without turning every security issue into an escalation.

Table Stakes Still Matter

Most security work is less dramatic.

Patching systems, encrypting devices, managing access, protecting endpoints, testing backups, and collecting logs are part of running a healthy environment.

They matter because attackers still use basic weaknesses.

Table stakes work best when it becomes part of the machinery of the company. Automate it where possible. Set sensible defaults. Measure whether it is happening.

Keep doing it.

A focus on major risks should never become an excuse for letting basic hygiene decay.

Judgment Sits in the Middle

The difficult decisions live between an intolerable risk and routine hygiene.

A vulnerability may be serious without requiring an emergency response. A new SaaS application may create risk without needing a six-week security review. A vendor may need additional scrutiny based on the access and data involved.

This is where security teams earn trust.

Look at the exposure, the likely impact, the path an attacker could take, and the effort required to address it.

Then make a decision.

Boiling the Ocean Is Expensive

Security programs can easily expand into enormous improvement efforts.

Every old system becomes a remediation project. Every control gets redesigned. Every application enters a review cycle. Teams build large roadmaps filled with work that may take years to complete.

The organization stays busy while important risks compete for the same people and money.

There will always be another control to improve.

Good prioritization means accepting that some work can wait.

Spend Effort Where It Changes the Outcome

A useful question for any security investment is simple:

What changes if we do this?

Sometimes a small change closes a major attack path.

Sometimes months of work produce a cleaner process with little change in exposure.

Security teams need to understand that difference before committing resources.

The goal is to reduce meaningful risk while allowing the business to keep moving.

Keep Reassessing

Risk changes.

Infrastructure changes. Vendors gain access. New systems appear. Threats evolve. A control that was sufficient last year may need attention today.

The line between table stakes and intolerable risk can move with it.

Regular visibility helps teams see those changes early and decide where attention belongs.

Final Thought

Do the table stakes well.

Know which risks are intolerable.

Use judgment everywhere in between.

A strong security program does not try to fix everything at once. It knows what needs attention now, what should run quietly every day, and what can wait.