Risk

Risk is two questions at once. How likely is this? And how bad would it be?

Answering only the second gives you a frightening story, not something you can act on. "Someone could steal all our customer records" is alarming, but it does not tell you whether to deal with it this week or next year. Add how likely it is and you can start putting things in order. It is why a small nuisance that happens every month can deserve more of your attention than a catastrophe that has never happened to anybody.