Risk: Turning evidence into priority
Stage 2 · piece 5 of 7
How bad is it, and how confident are we?
Risk turns Uncover’s evidence into a defensible priority. The phase combines impact, likelihood, attacker sophistication, and business context to decide what happens next.
What Risk is for
Uncover answered “what happened.” Risk answers “how much does it matter, and how confident are we.” The two pieces together drive the escalation decision, the resource allocation, and the documented justification that survives the case.
What you will get from this chapter
The three pillars
Impact and likelihood
The two dimensions every Risk verdict is built from: how to evaluate each separately, and how the combination produces the priority.
Read →Framework
The risk-based alert triage matrix. Asset criticality, threat actor intent, exploitation and scope, business impact, with CVSS as input when a vulnerability is in play.
Read →The value of a false-positive
Closed cases are not wasted cases. Each false-positive sharpens the detection logic and the analyst’s instinct.
Read →The dynamic loop: Scope → Uncover → Risk
Triage is not strictly linear. The investigative engine of ASSURED is an iterative loop through Scope, Uncover, and Risk that runs until clarity is reached. Risk findings often send the analyst back to Uncover for more evidence; new evidence sometimes forces a fresh Scope decision; that fresh Scope reframes what Uncover and Risk look at next. Embracing the loop is part of the methodology.
Initial Scope
Define investigation boundaries from the alert context. Deliberately narrow at the outset to keep noise down.
Uncover evidence
Gather and analyze data from targeted sources. Bounded by the current scope to avoid sprawl.
Assess risk
Evaluate impact and likelihood based on what was found. The decision is one of three: close, escalate, or rescope.
Refine scope
Adjust boundaries based on new understanding. Reactivates the loop with updated parameters.
Triggers that send you back through the loop
The loop iterates when something surfaces the original scope did not anticipate: signs of lateral movement into unscoped systems, use of alternate user identities or service accounts, possible data staging or exfiltration, or discovery of a high-value or compliance-sensitive asset that was not in the original entity map. Each pass increases investigative fidelity. For unresolved cases the loop terminates when the residual risk is sufficiently understood to justify resolution, close, escalate, or hand off. One exception outranks the loop: the moment any finding hardens from suspicion into a confirmed escalation criterion, the break-glass rule fires and the case escalates from wherever the loop is standing, with further iterations continuing under IR’s clock.
Why Risk is its own phase
Uncover answers what happened. Risk answers how much it matters. Skipping Risk means escalating every finding equally, which is the same as not prioritizing at all.
A high-impact finding with low confidence in the evidence is a different decision than the same finding with airtight evidence. Risk requires the analyst to state both explicitly.
The same intrusion on a sandbox is not the same intrusion on a regulated production system. Risk is the phase that brings that context into the priority decision.
A closed false-positive is a sharpened detection. The methodology asks the analyst to capture what they learned, even when the verdict is “no incident.”
Key Takeaway
Risk turns evidence into priority and confidence into a recorded verdict. The output is what the rest of the team acts on.