"So after you mitigate an inherent risk, like putting a firewall in place to protect a network, there's always some remaining risk that hackers might still be able to access the network. This is considered residual risk. Unless you're physically destroying the network, there's always going to be some level of residual risk left after you mitigate the inherent risk. As a fintech security analyst, I always consider what level of residual risk I'm willing to accept. Personally, I calculate residual risk by multiplying likelihood by severity. If it's highly likely that harm will occur and that it will be severe, then I consider the residual risk to be too high. But if the residual risk is low because it's unlikely anyone will be harmed and that it would be a slight harm, then I tend to view this as an acceptable amount of residual risk. When I consider and compare varying options given the resources available to me, I generally choose the one with the lower amount of residual risk."