Risk response is the action chosen after a cybersecurity risk has been assessed. The main options are to mitigate it, transfer part of the exposure, or accept it with clear approval from leadership. In practice, this is where analysis turns into action: a critical server may be patched, segmented, and monitored; some financial exposure may be shifted through contracts or insurance; and a low-impact issue may be accepted if fixing it would cost more than the damage it could cause.
This matters because assessment alone does not reduce risk. Security teams use risk response to focus limited effort on the weaknesses most likely to be exploited or to cause major business harm. In real defenses, response plans guide whether to deploy MFA, harden configurations, add logging, or formalize an exception. In attacks, high-value risks are often the ones defenders prioritize first, because delaying the response can leave a path open for intrusion, lateral movement, or data loss.