Probability

People reason badly about small probabilities, treating anything unlikely as effectively impossible and anything possible as likely.

Both errors appear constantly in risk discussions. A one-in-a-thousand annual event is not impossible; across a thousand systems it is routine. A theoretically possible attack requiring resources nobody has is not something to spend on. Distinguishing the two is most of what risk quantification is for.