In IT risk metrics, what does risk exposure measure?

• A. The uptime percentage of servers
• B. The number of security audits completed
• C. The amount of money spent on hardware
• D. The potential loss if a risk materializes

Answer: (D)

Risk exposure measures the potential loss if a risk materializes. It captures the financial impact a threat could cause if it exploits a vulnerability, often encompassing both how likely the event is and how severe the damage would be. This is what you use to prioritize risk responses—asking “how bad could it get” rather than just describing uptime, audits, or hardware spend. Uptime is an availability metric, audits are governance activity, and hardware spending is a cost, but none directly quantify the damage a risk event could cause. In practice, exposure is often thought of as the expected monetary loss, or the potential impact in dollars if the risk occurs.