The level of risk that exists before any controls or mitigations are applied.
Inherent risk is the raw exposure of an activity or asset, assessed as if no controls were in place. It provides a baseline against which the effect of controls can be measured.
Comparing inherent risk with residual risk shows how much a set of controls actually reduces exposure, which helps justify investment in those controls.
KaitoSec