Every vendor involved in security talks about risk. But risk as a concept is tough to grasp – it just means something bad can happen to your organisation, not that it will necessarily happen. Somehow, you’re supposed to equate the presence of some level of risk with an equal level or priority within IT. Often,