Tail risk is the danger of rare but extreme outcomes at the edges of a probability distribution. In cyber security, it describes low-frequency events that can still cause outsized damage, such as a major breach, a rapid privilege escalation, a widespread service outage, or a sudden loss of model reliability. Average-case metrics can hide these outcomes, so a system may look safe until an edge case appears.
Tail risk matters because attackers often aim for high-impact failures rather than common ones. A small chance of a bad configuration, a chained exploit, or an unexpected data shift can become the main source of loss. Defenders account for tail risk with stress testing, red teaming, incident simulations, anomaly detection, and conservative controls for critical assets. In AI-driven security tools, it also means watching for rare inputs that trigger false positives, false negatives, or unsafe actions. Managing tail risk is about preparing for the worst plausible case, not just optimizing the average case.