Author: Taylor Kerber, CISSP, CRISC
Published: July 17th, 2026

Understanding Personal Risk

As both an educator who teaches Cyber Security at Hennepin Technical College and a Cyber Security / Information Security Professional with roughly ten years in the industry, I have personally been involved in mitigating, preventing, and analyzing many high severity incidents and breaches and would like to share some of my knowledge to help others better understand some basic security practices. Pop culture and media portrayals of Information Security have long romanticized the industry and what our day-to-day job entails. While I’ve primarily worked in what is considered a blue team role, also known as a defensive role, I often work closely with Ethical Hackers / Penetration Testers to validate and test existing security controls.  My experiences and knowledge have made me personally hold a more holistic and practical view of Information Security. 

At their core, many Information Security decisions that organizations make can be distilled down to a formula that usually includes the following:

• Asset = Anything of value that needs protection — can be information, people, physical assets, etc. 

• Vulnerability = Flaw, weakness, gap, or misconfiguration in a process, system, or environment. 

• Threat = Potential event or action that can act upon and utilize a vulnerability and cause damage or harm.

• Risk = The result of the exploitation or action from a threat happening. 

Think of this in simpler terms like owning a car. If you live in North America like me, you likely own a vehicle to get around. My vehicle is an asset I own that allows me to get to work, get groceries, and perform many other essential tasks that modern life requires and has a high monetary value. Now let’s say this vehicle gets stolen and damaged (threat) — it will need to be replaced in its entirety and that event and its likelihood of happening is a risk. I cannot personally afford to accept and own this risk, and I am legally required to carry insurance, so I do not have to worry. In this example most of us use risk transference and risk sharing which means we pay an insurance company to take the burden of that risk for us in the form of a monthly premium. The insurance company manages our risk, and millions of other vehicles owners' risk for a price. The insurance company is essentially betting (with a lot of math) that we will not need to use their services monetarily more than we pay in. Additionally, the insurance company is calculating the price of our individual premium based on the likeliness of our risk being realized. This is often calculated with information like our driving history, the type of car we drive, our age, and where we live. So, what does car insurance have to do with Information Security and why am I talking about risk management (yawn)? Because many of these concepts can be used by everyday technology users to better understand their own vulnerabilities, threats, and risks. 

I mentioned earlier that I’ve personally been involved in a lot of high severity breaches and incidents. Well, anecdotally many of those did not involve some elite hacker or advanced Nation-state threat actor. Alas, many security incidents are often the byproduct of mundane misconfigurations, default passwords, and lack of even basic security controls but these seemingly low hanging vulnerabilities can cost a lot of monetary and reputational damage. Can you think of some of your own personal risks and what they may look like? Losing a lifetime of precious family photos because they were all on a single physical hard drive that failed is a risk that could be mitigated with a $120 yearly subscription to a service like Dropbox. Similarly, a yearly anti-virus subscription could mitigate and reduce the risk of harmful malware infecting your PC and gaining access to sensitive personal information. To help get creative and identify your own personal risks, threats, and vulnerabilities — I've created and attached a guide as seen below. This guide is a quick user-friendly reference with tools and practices that can help everyday users of technology identify and mitigate personal risks of their own. Not all the tools in this guide are free, but many are lower cost options and could greatly reduce and mitigate personal risks while creating a safer and more secure digital world.