Consequence analysis is a security and safety method used to identify the worst credible outcomes of system failure, misuse, or manipulation before any controls are chosen. In cyber-informed engineering, it helps designers ask not just whether an attacker can reach a system, but what damage could follow if a controller is altered, a sensor is spoofed, or a communications link is lost.
This matters because the most important cyber risk in industrial and critical infrastructure environments is often physical or operational harm, not data theft. By mapping unsafe states, essential functions, and failure paths, teams can decide where to add isolation, redundancy, manual fallback, fail-safe logic, or other safeguards. In practice, consequence analysis supports better architecture decisions, stronger resilience, and a more realistic defense strategy: reduce the blast radius of compromise rather than assuming intrusion can always be prevented.