Risk Glossary

Browse 73 risk terms defined in plain English, from the cultural dictionary of computing.

73 Risk Terms

Attacker Profile
A description of an expected attacker type, including capability, motivation, resources, and likely tactics. Attacker profiles help teams tailor defenses to...
Attack Surface
Attack Surface is the total set of reachable interfaces, services, identities, code paths, and trust relationships an attacker can target. Security teams use...
Big Rewrite
A sweeping plan to rebuild a system from scratch rather than improving it incrementally. In engineering slang, the big rewrite is usually discussed with...
Bleeding Edge
Describing technology that is extremely new and advanced, often to the point of being unstable or poorly proven. In engineering slang, bleeding edge highlights...
Blind Merge
A merge done with little or no meaningful review, testing, or understanding of the change. In engineering slang, a blind merge is usually mentioned critically...
Bug Mine
A part of the system where hidden bugs are densely packed, waiting to explode when someone touches the code. In engineering slang, a bug mine suggests old...
Bus Factor
The minimum number of team members who would need to be suddenly unavailable (hit by a bus, quit, go on vacation) before a project stalls due to loss of...
Bus Factor
The minimum number of team members who would have to be hit by a bus (or otherwise suddenly unavailable) before a project stalls due to lack of knowledge. A...
Bus Factor One
The most dangerous state for any project: a bus factor of exactly one person. If that person leaves, gets sick, or is hit by the proverbial bus, critical...
Bus Factor OSS
The risk in an open source project that too much critical knowledge or authority is concentrated in too few maintainers, so losing them would severely harm...
Can of Worms
An idiom for a topic or change likely to uncover many new complications once opened. In engineering culture it often describes legacy systems, migrations, or...
Code Gamble
A risky technical choice made in the hope that the downside will not materialize before the upside is realized. In engineering slang, a code gamble may be...
Code Grenade
A small-looking change or hidden issue that can explode with disproportionate impact when touched. In engineering slang, a code grenade is dangerous precisely...
Code Hazard
A piece of code or technical situation that creates material risk for correctness, security, or operability. In engineering slang, calling something a code...
Code Mine
A hazardous zone in the codebase filled with hidden pitfalls and fragile assumptions. In engineering slang, code mine overlaps with bug mine, but often...
Code Rogue
An engineer or code path acting outside expected controls, standards, or ownership boundaries. In engineering slang, code rogue suggests something has broken...
Cold Deploy
A deployment performed without recent warm-up, rehearsal, or recent familiarity with the exact path being used. In engineering slang, a cold deploy feels...
Common Vulnerability Scoring System
Common Vulnerability Scoring System is a standardized method for rating vulnerability severity based on exploitability, impact, and environmental factors....
Cowboy Merge
A merge done boldly and with insufficient caution, often bypassing ordinary review or coordination. In engineering slang, cowboy merges are associated with...
Cutting Edge
Describing technology as highly advanced and very recent, often with an implied tradeoff in stability or maturity. In engineering slang, cutting edge can be...
CVSS Score
The numerical severity score assigned under the Common Vulnerability Scoring System, intended to estimate the technical seriousness of a vulnerability. CVSS is...
Cyber Insurance
Cyber Insurance is insurance coverage and underwriting practices related to cyber incidents, recovery costs, and organizational controls. Security teams use it...
Cyber Threat
Any actor, capability, or condition that could exploit digital systems to cause harm, theft, disruption, or unauthorized access. A cyber threat can be a...
Dark Data
Data that an organization collects, stores, or generates but does not actively use, understand, or manage well. In data culture dark data is often seen as both...
Dark Debt
Hidden technical debt in machine learning systems that's harder to detect than traditional code debt. Includes training-serving skew, undeclared data...
Death Valley
A dangerous period where a startup has not yet reached sustainable traction or financing stability but is already consuming significant resources. It is...
Defense in Depth Culture
A culture that assumes single safeguards will fail and therefore builds multiple layers of protection, review, and recovery. In security-minded teams, defense...
Deploy Friday
The act of deploying code on a Friday, often invoked as a risky or controversial move because recovery time and staffing may be worse going into the weekend....
Digital Security
The protection of digital systems, identities, data, and communications from unauthorized access, disruption, or misuse. In culture discussions digital...
External Dependency
A dependency outside the direct control of a team, such as another vendor, team, service, regulator, or partner. In planning culture, external dependencies are...
Fail-Open
Fail-Open is a design behavior where a system stays available when a control fails, even if that weakens security. Security teams use it to enforce trust,...
Failure Mode
A specific way in which a system, process, or component can fail. In engineering culture, thinking in failure modes helps teams prepare for real breakage...
FOMO Investing
Venture capital investment driven by fear of missing the next big thing rather than sound analysis. When VCs hear a competitor invested, rational evaluation...
Friday Deploy
Deploying code changes to production on a Friday — universally regarded as reckless because if something breaks, you either ruin your weekend fixing it or...
Front Page Test
A gut-check asking whether you would still defend a technical decision if it were publicly exposed in a highly visible way. In engineering slang, the front...
Future Proof
To design something in a way intended to remain useful and adaptable as needs, technology, or conditions change. In engineering culture the phrase is useful up...
GRC
Short for governance, risk, and compliance, the organizational framework used to manage policies, control requirements, audits, and risk decisions in a...
Hack Value
The perceived usefulness or attractiveness of a target, vulnerability, or dataset from an attacker's perspective. Something with high hack value may offer...
House Money
Capital or gains treated psychologically as easier to risk because they are seen as winnings or surplus rather than hard-earned principal. In startup and...
Human Factor
The influence of human behavior, error, incentives, cognition, and decision-making on security outcomes. The human factor is central to phishing, privilege...
Information Security
Information Security is the discipline of protecting confidentiality, integrity, and availability across information systems and data. Security teams use it to...
Insider Threat
Insider Threat is the risk posed by employees, contractors, or partners who misuse legitimate access intentionally or accidentally. Security teams use it to...
Known Unknown
A risk or gap you are aware exists even though you do not yet know the exact answer. In engineering slang, distinguishing known unknowns from surprise unknowns...
Late Night Deploy
A deployment done late at night, usually carrying extra drama because fatigue and reduced support overlap make mistakes harder to recover from. In engineering...
Live Demo
A real-time product or technical demonstration performed directly in front of an audience rather than shown through prerecorded video. Engineers respect live...
Living on the Edge
Operating with unusually high risk, novelty, or instability, often by choice. In engineering slang, it usually means depending on unstable tooling, shipping...
Market Risk
The possibility that demand, pricing, timing, or broader market conditions will make a business underperform even if the product is competently executed....
Merge and Pray
To merge code with insufficient confidence and then hope tests, deploys, or users do not reveal disaster. In engineering slang, merge and pray is what happens...
Model Collapse
A phenomenon where AI models trained on AI-generated data progressively degrade, losing diversity and accuracy over generations. The ouroboros of AI — models...
No Plan B
A situation where only one path forward exists and fallback options are missing or unrealistic. In engineering slang, having no plan B is a major risk smell,...
Operational Security
Operational Security is the practice of protecting sensitive activities, plans, and capabilities from observation or inference. Security teams use it to...
Outside Threat
A threat that originates outside the organization or trusted environment, such as criminal groups, nation-state operators, internet attackers, or hostile...
Patch Gap
The period or coverage difference between when a fix is available and when all affected systems have actually been patched. Patch gaps are where many...
Poke the Bear
To touch a volatile person, system, or situation in a way that may trigger a disproportionate negative reaction. Engineers say it when they fear waking up...
Power-Seeking
Describing behavior that tends to pursue more control, resources, or influence as an instrumental means to achieving objectives. In AI safety discussions,...
Production Roulette
A deployment or operational environment where outcomes feel random because safeguards, visibility, or understanding are too weak. In engineering slang,...
Red Line
A hard boundary or limit that should not be crossed, whether technical, operational, legal, or organizational. In engineering it often marks unacceptable risk...
Regulatory Risk
The risk that laws, regulation, enforcement actions, or licensing requirements will materially hurt the business model or growth path. Regulatory risk is...
Remediation Priority
The relative urgency assigned to fixing a vulnerability, weakness, or control gap based on factors such as exploitability, asset value, exposure, and business...
Risk Priority
The relative order in which risks should be addressed based on business importance, exploitability, exposure, and available resources. Risk priority is what...
Risk Quantification
The practice of expressing security risk in measurable terms such as expected loss, financial ranges, or modeled probabilities rather than only qualitative...
Risk Tolerance
The degree of uncertainty, downside, or volatility a person or organization is willing to accept when making decisions. Startup strategy often depends as much...
Single Point of Failure Slang
Informal language for any person, service, component, or process whose failure can take down a larger system. In engineering slang, calling something a single...
Straight to Production
A dramatic or reckless path where code goes live with minimal staging, review, or gradual rollout. In engineering slang, straight to production is usually said...
Sword of Damocles
A constant looming threat hanging over a project or system. In engineering slang, it is used for major risks everyone knows exist but has not yet resolved.
Test in Production
To rely on real users or live systems as the proving ground for a change, intentionally or by neglect. In engineering slang, testing in production can be...
Toxic Code
Code that causes harm every time people touch it, whether through hidden coupling, dangerous side effects, or chronic unreliability. In engineering slang,...
Trust Fall
A move that depends heavily on other people or systems doing their part correctly. In engineering slang, a trust fall is any design choice where one layer...
Unknown Unknown
A risk or factor you do not even know exists yet, making it impossible to plan for directly. In engineering slang, unknown unknowns are why humility matters in...
Unknown Unknowns
Risks or factors you do not yet know exist, making them impossible to plan around directly.
Weekend Deploy
A deployment performed on a weekend, usually because business constraints, maintenance windows, or risky migrations made normal hours undesirable. The term...
What Could Go Wrong
A sarcastic phrase said before a risky action, usually when the speaker knows many things could in fact go wrong. It is common in deploys, demos, and...
Worst Case
The most damaging plausible outcome being considered. In engineering slang, discussing worst case is how teams keep optimism from substituting for planning.

Related Topics