[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Inherent Risk vs. Residual Risk (Explained in 58 Seconds)](/blog/inherent-risk-vs-residual-risk) Publish date July 4, 2025 {x} minute read # Inherent Risk vs. Residual Risk (Explained in 58 Seconds) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) Inherent risks include all security risks that are present without any security controls. Residual risks are the security risks that remain after security controls are implemented. Residual risks are inevitable. Even with an abundance of security controls, vestiges of residual risks will remain that could expose your [sensitive data](https://www.upguard.com/blog/sensitive-data) to [cyber attacks](https://www.upguard.com/blog/cyber-attack). This is because the [digital transformation](https://www.upguard.com/blog/digital-risk) combines the threat landscapes of your vendors with your own, essentially making their security risks, your security risks. Because residual risks are unavoidable, their effective management involves the pursuit of the optimal balance between acceptable and unacceptable risks. When implementing security controls, the objective should be to suppress the inherent risk factor as far below your risk threshold as possible, There are exceptions for critical processes exceeding the risk threshold. These should sit within a tolerance threshold that has been carefully defined to support the safety and integrity of sensitive resources while still permitting risks beyond the threshold. [Learn how to calculate the risk appetite for your Third-Party Risk Management program.\ ](https://www.upguard.com/blog/risk-appetite-calculation-third-party-risk-management) ## Why is Residual Risk Important? Residual risk is important because most cybersecurity regulations, such as ISO 27001, require organizations to implement security controls to monitor and manage risk tolerance. Highly regulated industries, such as healthcare entities and financial institutions, are under particular pressure to implement the best enterprise risk management strategies into business processes. This is because the consequences of poor [information security](https://www.upguard.com/blog/information-security) practices in these industries are [very severe](https://www.upguard.com/blog/cybersecurity-regulations-financial-industry). Effective residual risk management is a combination of internal controls and external risk controls. The external component is especially important because of the significant cyber risks and third-party risks that are introduced during the vendor onboarding process In the absence of controls, manual risk analysis across a rapidly expanding digital attack surface is a logistical impossibility. For the most effective risk management strategy, an attack surface monitoring solution should be implemented. These solutions help security teams rapidly scale their risk assessment efforts by keeping them informed of current risk levels, vendor risk scores, the risk impacts if new cloud solutions and risk profiles of each vendor. The most sophisticated attack surface monitoring solutions also offer [Vendor Tiering](https://www.upguard.com/blog/what-is-vendor-tiering), a means of categorizing vendors based on the types of risks and amount of risk they introduce to an ecosystem. [Learn more about residual risks.](https://www.upguard.com/blog/residual-risk) ## Why is Inherent Risk Important? Understanding inherent risk and inherent impact is important because it helps security teams understand the current level of risk and the set of controls required to successfully address all risk factors. This essential prerequisite to the implementation of a cybersecurity program ensures the efficiency of [security posture strengthening](https://www.upguard.com/blog/security-posture) efforts. [Learn more about inherent risks](https://www.upguard.com/blog/what-is-inherent-risk). ## Key Takeaways * Inherent risks are the security risks within an IT ecosystem in the absence of security controls. * Residual risks are the security risks that remain in an IT ecosystem after security controls have been implemented. * Some security controls introduce additional residual risks, known as secondary risks. * Security controls should suppress inherent risk levels as far below the risk threshold as possible. * A vendor's risk profile can be identified through [risk assessments](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) or [security questionnaires](https://www.upguard.com/blog/security-questionnaire). Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)