Harnessing the Pareto Principle in Risk Management
80% risks can be managed with just 20% of efforts? The Pareto 80/20 rule is a useful concept in risk management.
Hopefully all stakeholders in cybersecurity are keenly aware that risk cannot be entirely eliminated - hence the need for balanced risk management.
Furthermore, cybersecurity regulations increasingly emphasize risk management to improve security posture and reduce exposure to threats. For ex. the upcoming NIS2 directive mandates that affected organizations have a risk and information security management system in place. In practice, this means performing regular risk assessment exercises that aim to identify, treat, and monitor an organization's cyber security risk.
Having all this in mind, it's not wonder many cybersecurity solutions are now including functionalities aimed at CISOs and cyber risk management, including building a risk model in order to calculate the per-zone likelihood of attacks and the effectiveness of corresponding risk-mitigation measures.
The Pareto Principle – otherwise known as the 80-20 rule – named after the economist Vilfredo Pareto, states that roughly 80 percent of the effects or results are attributed to 20 percent of the causes or invested input.
For cybersecurity practitioners this translates into:
➡ 80% of the business risk that can cause the most harm comes from just 20% of the vulnerabilities.
➡ 20% of the cybersecurity investment into tools brings 80% of the value
