The term "cyber risk" aims to characterize a variety of phenomena where information assets are subject to a potential damage due to cyber attacks. Many attempts, almost unblemished by success, have been made to define cyber risk. In this talk we explore why the concept of cyber risk, as treated by both practitioners and researchers of cyber security, is largely inconsistent with definitions of cyber risk commonly offered in the literature. Unsurprisingly, an adequate ontology of cyber risk is lacking, and a rigorous re-conceptualization of cyber risk is needed.

A new formal treatment of cyber risk that should include an ontology of cyber risk-related concepts, a rigorous mathematical model, and practical definitions, all of which must align with common sense perceptions of cyber risk by cyber security practitioners. Furthermore, cyber risk belongs firmly to the realm of adversarial decisionmaking and has little meaning outside of a process geared toward decisions made under extreme uncertainty, time pressure, and under threat of an adversarial actions pre-empting and counteracting those of the defenders. Modeling of risk must be adversarial in nature, with game-theoretic and decision-theoretic perspectives duly considered. And to add to the confusion, we must discuss how inseparably connected yet different are cyber risk and cyber resilience.