A risk-based approach is a security method for choosing safeguards according to two factors: how likely a threat is and how much harm it could cause. Instead of applying the same controls everywhere, defenders prioritize the systems, users, and data that create the greatest exposure. In GDPR and other compliance frameworks, this is the basis for deciding what “appropriate” protection looks like.
In cyber security, this approach is used in access control, encryption, logging, vendor review, and incident response planning. For example, highly sensitive personal data may justify stronger authentication and tighter monitoring than low-value internal data. Attackers also exploit weak risk assessment by targeting overlooked assets, outdated controls, or third-party services that were never re-evaluated. A good risk-based program is dynamic: when business processes, data flows, or threats change, the safeguards should be reviewed and adjusted. It matters because security that is not tied to real risk can waste effort on low-value controls while leaving critical weaknesses exposed.