These two terms are used interchangeably in most organisational governance conversations, and in casual usage that rarely matters. When it comes to structuring risk governance, deciding which function owns what, designing an appropriate control framework, or meeting regulatory expectations about risk categorisation, the distinction becomes material.
The misuse of the terms creates governance problems in both directions. Treating all technology risk as cybersecurity risk means non-adversarial technology risks, system reliability, data quality, change management, and legacy infrastructure, get managed under a security lens that does not fit them.
Treating cyber risk as simply part of general IT risk, with no specific acknowledgement of the adversarial dimension and its distinctive characteristics, tends to underweight a category of risk that regulators, insurers, and counterparties are increasingly focused on.
IT risk is the full range of risks associated with information technology, encompassing everything that could go wrong in how an organisation uses, governs, and depends on technology, regardless of whether any malicious actor is involved.
A system outage caused by a hardware failure is IT risk. A software bug that produces incorrect financial calculations is IT risk. A poorly managed technology migration that disrupts operations for several days is IT risk. A legacy system that has become difficult to patch and increasingly unreliable is IT risk. Data quality deterioration that produces inaccurate management reporting is IT risk. None of these require an attacker.
What makes these risks "IT" risks is not their consequences, which can be as severe as any cyber incident, but their origin: they arise from how technology systems are built, operated, and governed, from decisions and processes within the organisation's own control.
One practical consequence of conflating cyber risk with IT risk is that non-adversarial technology risks receive less governance attention than they warrant. When the framing is "security," risks that have nothing to do with security get managed under inappropriate frameworks or managed informally without structured governance.
System reliability risk, for example, is one of the most operationally significant technology risks most organisations face. The increasing dependence of core business processes on technology means that a significant outage, even without any security dimension, can halt operations, affect customers, trigger regulatory reporting obligations, and cause financial loss. Managing this as a peripheral concern because it does not fit the cybersecurity narrative is a governance failure.
Cyber risk is a specific subset of IT risk: the risk arising from malicious or unauthorised activity targeting information systems and data. This covers cyberattacks including ransomware, phishing, business email compromise, and distributed denial of service; data breaches involving unauthorised access to or exfiltration of sensitive information; insider threats involving deliberate misuse of legitimate access; and state-sponsored activity targeting critical infrastructure or sensitive data.
Every cyber risk is an IT risk, because it involves information technology. Not every IT risk is a cyber risk, because many technology failures have no adversarial dimension.
The defining characteristic of cyber risk is the presence of an active, adaptive adversary. This changes the management approach in several ways that distinguish cyber risk management from general IT risk management.
Threat intelligence becomes relevant. General IT risk management draws primarily on the organisation's own experience and on the failure characteristics of the technology it uses. Cyber risk management requires understanding the external threat landscape: who is attacking organisations like this one, with what techniques, and with what objectives. The NIST Cybersecurity Framework's govern function emphasises the importance of understanding the external threat context as a foundation for cybersecurity strategy.
The pace of change is different. General technology risk changes at the pace of the organisation's own technology evolution. Cyber risk changes at the pace of the threat landscape, which evolves continuously as adversaries develop new techniques, as vulnerabilities are discovered and disclosed, and as geopolitical conditions affect the threat environment.
Regulatory reporting obligations are distinct. Major cyber incidents trigger specific notification obligations under DORA, NIS2, UK GDPR, and other frameworks, with defined timelines and content requirements. General technology failures may trigger regulatory reporting but typically under different thresholds and through different channels.
Managing general IT risk requires expertise in system architecture, change management, IT operations, and technology governance. Managing cyber risk additionally requires expertise in threat intelligence, security operations, incident response, and adversarial thinking. While these capabilities overlap and should inform each other, treating them as identical risks leaving one or both inadequately resourced.
Many organisations have strong IT operations capabilities and weak security operations capabilities, or vice versa. A risk taxonomy that fails to distinguish the two makes it harder to identify and address these gaps.
Boards benefit from seeing cyber risk and non-adversarial IT risk reported in ways that reflect their distinct characteristics. Cyber risk reporting should address the current threat landscape, the organisation's exposure to prevalent attack types, the maturity of detection and response capabilities, and significant incidents or near-misses. IT risk reporting should address system reliability, the technology change programme, legacy risk, and data quality.
When these are combined into a single undifferentiated "technology risk" report, the board cannot form an accurate view of either dimension. The specific questions that follow from each type of risk are different, and conflating them tends to mean neither receives adequate scrutiny.
Cyber insurance covers losses from malicious cyber activity, typically including ransomware payments, breach response costs, business interruption from attacks, and liability from data breaches. It does not cover general technology failures that have no malicious dimension. General business interruption insurance may or may not cover technology outages depending on the policy terms.
Regulatory frameworks similarly distinguish between the two. DORA's incident reporting requirements cover ICT incidents including both malicious and non-malicious causes, but the classification of incidents as major partly depends on their characteristics, and the supervisory response differs based on whether a breach was involved.
The most practically useful approach is to treat IT risk as the parent category, with cyber risk as a clearly defined subset. Under IT risk, five sub-categories cover the full scope:
Cyber risk covers malicious and unauthorised activity including external attacks, data breaches, ransomware, and insider threats. This sub-category warrants dedicated expertise, specific monitoring tools, threat intelligence, and distinct regulatory reporting processes.
System availability and reliability risk covers technology failures, outages, and performance degradation from non-malicious causes. This includes hardware failures, software defects, power and connectivity disruptions, and capacity constraints.
Change and project risk covers the risks introduced by technology changes, implementations, and migrations. This is a consistently underweighted category that generates a high proportion of operational incidents.
Data and integrity risk covers data quality, accuracy, and completeness failures that produce incorrect outputs from technology systems. As organisations rely increasingly on data for management decisions, regulatory reporting, and customer interactions, data integrity risk deserves explicit treatment.
Third-party and cloud risk covers dependencies on external technology providers, cloud platforms, and managed services, including the risks of provider failure, service degradation, and vendor lock-in.
This structure allows the organisation to apply appropriate governance, appropriate expertise, and appropriate controls to each sub-category, rather than managing the full range of technology risk under a single framework that fits none of them perfectly.
