How to Decide Which Security Risks to Fix, Accept or Insure

A 70-person company has a list of security gaps and a budget that covers about half of them. The IT provider says everything on the list matters. The insurance broker says the policy will cover the rest. The owner has to decide what gets fixed this quarter, what waits, and what nobody will touch, and nobody has given them a method for making that call.

Every company at this size makes these decisions, whether or not anyone writes them down. The difference is whether they are made on purpose, by someone with the authority to make them, or by default because a ticket never got picked up.

The four choices every risk has

NIST defines risk response as an intentional, informed decision to accept, avoid, mitigate, share, or transfer an identified risk. For a growing company, that list collapses into four practical choices:

Fix it (mitigate). Add a control that lowers the likelihood or the damage. Turn on multi-factor sign-in, test the backups, remove old accounts.
Stop doing it (avoid). End the activity that creates the risk. Retire the old file server, stop storing card numbers, drop the vendor that will not meet your requirements.
Insure it (transfer or share). Pay someone else to carry the financial loss. Cyber insurance is the main tool here, and contract terms with vendors are another.
Accept it. Decide the risk is small enough, or the fix expensive enough, to live with it. This is a legitimate choice, but only when someone with authority makes it knowingly and records it.

Most companies already use all four. They just use them inconsistently. A gap gets "accepted" because the person who found it left. A risk gets "insured" because the broker mentioned it once. Neither was a decision.

Why insurance is not a substitute for fixing

Insurance pays for money lost. It does not restore a customer's trust, bring your systems back faster, or keep your name out of a breach notice. It also comes with conditions.

Cyber insurance applications ask what controls you run, and policies are written on the answers. Commentary from brokers and attorneys describes two common ways an insurer contests a claim: the insured did not maintain a control the policy required, or the application described controls that were not really in place. In one widely reported pattern, forensic work after an incident finds that multi-factor sign-in was missing for some accounts, and the insurer points to the application. Whether a specific claim holds up depends on the policy wording, so read yours with that in mind.

The practical rule: insure the losses you cannot afford, and fix the controls the policy assumes you have. If the application says all remote access uses multi-factor sign-in, that statement is now a commitment. Our guide on answering a cyber insurance questionnaire covers how to answer those questions accurately.

How to size a risk without guessing

You do not need a model with hundreds of inputs. You need three numbers, each a rough estimate, written down.

What it would cost. Include downtime, recovery work, lost billings, notification and legal costs, and any contract penalties. For scale, IBM's 2025 Cost of a Data Breach report put the global average breach at $4.44 million and the US average at $10.22 million. Those figures skew toward larger organizations, so use them as an upper reference, not a prediction for a 70-person firm. Your own number should come from your revenue per day, your recovery time and your contracts.
How likely it is. Use three levels: unlikely this year, plausible this year, expected this year. Phishing and stolen passwords are expected at nearly every company. A targeted break-in to a locked-down server is unlikely.
How hard it is to fix. Hours, cost and disruption. A control that takes a week and no new spending is a different decision than one that takes a quarter and a new platform.

Multiply nothing. Put the three answers next to each other and let the combination point to a choice.

Cost if it happens	Likelihood	Cost to fix	Usual choice
High	Plausible or expected	Low or moderate	Fix now
High	Plausible	High	Fix in phases, insure the gap
High	Unlikely	High	Insure, review yearly
Low	Any	Low	Fix when convenient
Low	Unlikely	High	Accept, in writing

Notice what the table does not say. A high-cost, likely risk with a cheap fix is never a candidate for acceptance. Many of the highest-value fixes are inexpensive: multi-factor sign-in, tested backups and removing departed employees' access.

What good acceptance looks like

Acceptance fails when it happens by neglect. A risk is accepted properly when the record shows five things:

A plain description of the risk, with no jargon
The estimated cost and likelihood
Why fixing it now is not worth it
The name of the person who accepted it, who has the authority to spend the money it would take to fix
A date to look at it again, usually within a year

The owner of the business unit or the CEO normally signs, not the IT provider. IT can recommend. The person who would answer to customers, clients and the board if it goes wrong decides.

Keep the decisions in a risk register

A risk register is a single list with one row per risk. It does not need special software. A shared spreadsheet works. Each row holds the risk, the three estimates, the chosen response, the owner and the review date.

The register earns its keep in four situations:

Insurance renewal. Your answers on the application come from decisions already made, not a scramble the week before the deadline.
Client security reviews. When a customer asks how you manage risk, you hand over a structured answer.
Leadership and board updates. Ten rows sorted by priority beat a 40-page assessment.
Staff turnover. When the person who knew the history leaves, the reasoning stays.

Review it quarterly. Risks move: a new vendor is added, a regulation changes, a fix lands. Rows should close, and new ones should open.

Where the work usually stalls

Three patterns show up at companies without a dedicated security leader.

Nobody owns the final call. The IT provider can implement controls but usually cannot decide how much risk the business should carry. Our post on who should own security when you do not have a CISO goes through that gap.

Everything is rated critical. When every item is urgent, none gets done. The three-number approach forces a ranking.

Fixes stall after the decision. Choosing to fix a risk does nothing until someone runs the project, verifies the result and updates the register.

How Elevaire fits into these decisions

A virtual CISO provides the senior judgment: sizing the risks, recommending a response for each, writing the risk register, and presenting the choices to leadership so the owner makes informed calls. Elevaire Managed Security then carries out the "fix" decisions: managing the security tools and vendors, watching for threats, and stepping in when something goes wrong. Elevaire works alongside your existing IT provider or internal team and does not replace them.

Example engagement: a 70-person professional services firm has a long list of open findings from a recent assessment and a renewal due in 60 days. Elevaire would size each finding on cost, likelihood and effort, move the cheap high-impact fixes to the front of the queue, and document two low-risk items as accepted with a named owner and a review date. It would then map the renewal questions to the controls actually in place, so the application matches reality.

Frequently Asked Questions

How do I decide whether to fix a security risk or just buy insurance?

Fix the risks that are likely and cheap to close, and insure the large losses that remain after that. Insurance depends on the controls you stated on the application, so skipping a control the policy assumes can put a claim at risk. Treat insurance as the backstop, not the plan.

Is it ever okay to accept a security risk?

Yes. Accepting a risk is a normal business decision when the potential loss is small or the fix costs more than the exposure. It becomes a problem only when nobody decided, nobody wrote it down, or the person who accepted it had no authority to do so. Record the reasoning, the owner and a review date.

How much does a virtual CISO cost compared with a full-time hire?

A full-time security executive is a salary, benefits and recruiting commitment that most 25 to 200 person companies cannot justify. Elevaire provides virtual CISO leadership with predictable monthly pricing and no hourly billing, so leadership time is a known line item rather than a variable bill.

How does this work alongside our existing IT provider?

Your IT provider keeps running day-to-day systems. Elevaire adds the security decisions and the security operations on top: the risk register, the priorities, the tools and monitoring. We coordinate with your provider on any fix that touches their systems.

How do I get started with a risk register?

List every known security gap from past assessments, insurance applications and client questionnaires. For each one, write the cost if it happens, how likely it is this year, and what it takes to fix. Assign an owner and a review date. A first pass takes a few hours, and a vCISO can run the first one with you.