Evaluate risk
Risk work is a decision among mitigate, transfer, accept, and avoid. Argumont keeps residual risk on the page so a funded control cannot pretend to have closed ...
decision
Risk treatment is a decision, not a register
A risk register lists worries. A decision chooses a treatment. Argumont compares mitigation, transfer, acceptance, and avoidance with residual risk left visible.
What this decision type is
Risk management decisions include which control to fund, whether to buy insurance, whether to stop an activity, or whether to accept a residual. 'Be more secure' is not an option.
Argumont records severity, probability as the team understands it, and mitigation. It does not claim to know true probabilities.
Common mistakes
Scoring heat maps as if color were measurement. Colors can hide missing data.
Another mistake is funding a control because it is auditable, not because it reduces the actual loss path.
What evidence matters
Incident history, near misses, control effectiveness tests, and the cost of the treatment including delay. Absence of incidents is not proof of safety.
Example criteria
Loss reduction
Whether the treatment actually cuts the loss path.
Residual risk
What remains after you spend the money.
Treatment cost
Cash, attention, and operational drag.
Detectability
Whether failure of the treatment would be noticed.
Common risks
Control theater
The organization feels safer without a shorter loss path.
Transfer illusion
Insurance language is mistaken for coverage of this event.
Example decision
Fund a detection project, buy a policy, accept the residual for a quarter, or stop the activity. Acceptance should be explicit if it wins.
Related pages
Risk-adjusted decisions
Finance uses risk-adjusted return. Operators can use the same idea without a lecture: what is the downside, how likely, and who eats it.
Risk analysis
Argumont treats risk as something you can score alongside other criteria. Volume of imagined disasters is not the same as residual risk after a mitigation.
Cybersecurity
Security work is a sequence of tradeoffs under incomplete information. Argumont compares remediation options against exploitability, impact, exposure, and opera...
Decisions
These pages are not a directory of keywords. Each one describes a kind of choice, the evidence it needs, how Argumont scores it, and where to go next.
Compare risk treatments
Argumont challenges assumptions, researches evidence, compares competing approaches, and identifies the strongest decision.
Compare risk treatments