SER-003 — Risk Intelligence
**Risk intelligence** for analysts—how to prioritize findings using context, evidence, and threat inputs. **Not** enterprise GRC, compliance frameworks, or generic risk management.
SER-003 — Risk Intelligence
Series: SER-003
Version: 1.0
Fundamental question: How should organizations prioritize cyber risk?
Pillar: PIL-RISK
Season: SEA-005
Status: ✅ Complete — FROZEN (D1 drafts)
Review: Every 6 months (next: 2027-01-03)
Expansion: SER-003 v2.0 only — no new articles in v1.0
Learning path: LP-003
Prerequisite: SER-001 + SER-002 (minimum: KID-CON-0001, KID-CON-0019)
Purpose
Risk intelligence for analysts—how to prioritize findings using context, evidence, and threat inputs. Not enterprise GRC, compliance frameworks, or generic risk management.
Educational flow: Evidence → Investigation → Risk prioritization decisions
Authority anchors: KID-GLS-0004, KID-GLS-0020, KID-OIN-0001
Foundation for: SER-004 Attack Paths · SER-005 Threat Intelligence · SER-006 Operational Intelligence
Reading order
| Order | KID | Article | Difficulty | Time |
|---|---|---|---|---|
| — | — | Prerequisite: SER-001 + SER-002 | — | — |
| 1 | KID-GLS-0004 | Risk (term) | — | 3 min |
| 2 | KID-GLS-0020 | Risk Intelligence (term) | — | 3 min |
| 3 | KID-GLS-0003 | Security Context (term) | — | 3 min |
| 4 | KID-CON-0003 | Context Matters More Than Severity | Introductory | 8 min |
| 5 | KID-CON-0034 | Why Severity Alone Is Insufficient | Introductory | 10 min |
| 6 | KID-CON-0030 | Risk Context | Introductory | 9 min |
| 7 | KID-CON-0037 | Why Identical Findings Create Different Risk | Intermediate | 8 min |
| 8 | KID-CON-0035 | Business Context in Risk Decisions | Intermediate | 9 min |
| 9 | KID-CON-0031 | Risk Prioritization in Practice | Intermediate | 10 min |
| 10 | KID-CON-0038 | How Evidence Influences Risk Prioritization | Intermediate | 8 min |
| 11 | KID-CON-0032 | Risk Acceptance | Intermediate | 8 min |
| 12 | KID-GLS-0021 | Residual Risk (term) | — | 3 min |
| 13 | KID-CON-0036 | What Changes Risk Over Time | Intermediate | 8 min |
| 14 | KID-CON-0033 | Risk Communication | Intermediate | 9 min |
Analyst questions answered
| Question | Primary KID |
|---|---|
| Why isn't severity enough? | KID-CON-0034, KID-CON-0003 |
| What is risk context? | KID-CON-0030 |
| How should evidence influence prioritization? | KID-CON-0038 |
| Why do identical CVEs differ in risk? | KID-CON-0037 |
| What makes one asset more important? | KID-CON-0035 |
| What changes risk over time? | KID-CON-0036 |
| What should drive remediation order? | KID-CON-0031 |
| How explain prioritization to stakeholders? | KID-CON-0033 |
Glossary (series terms)
| KID | Term | Status |
|---|---|---|
| KID-GLS-0004 | Risk | ✅ shared |
| KID-GLS-0003 | Security Context | ✅ shared |
| KID-GLS-0020 | Risk Intelligence | ✅ |
| KID-GLS-0021 | Residual Risk | ✅ |
FAQs (attached)
| KID | Question | Primary parent |
|---|---|---|
| KID-FAQ-0016 | Why is CVSS not enough? | KID-CON-0034 |
| KID-FAQ-0017 | How do I prioritize vulnerabilities? | KID-CON-0031 |
| KID-FAQ-0018 | What is risk context? | KID-CON-0030 |
| KID-FAQ-0019 | How do analysts explain risk to executives? | KID-CON-0033 |
| KID-FAQ-0020 | What is risk intelligence? | KID-GLS-0020 |
Publishable bundle (debt)
| ID | Component | Status |
|---|---|---|
| DEBT-S3-001 | Pillar hub PIL-RISK | ⏳ |
| DEBT-S3-002 | Concept map MAP-011 Risk context layers | ⏳ |
| DEBT-S3-003 | Learning path LP-003 formal INDEX | ⏳ |
| DEBT-S3-004 | Whitepaper WP-004 Risk Communication Framework | ⏳ |
| DEBT-S3-005 | D2 review batch — 16 new assets | ⏳ |
Collection statistics
| Asset type | Count |
|---|---|
| Educational articles | 10 |
| Glossary terms (series) | 4 |
| FAQ attachments | 5 |
| New KIDs this collection | 16 |
| Cumulative registered KIDs | 89 |