ICT risk is the risk that failures, misuse, or attacks affecting information and communication technology will disrupt business operations. It covers more than malware: system outages, broken integrations, poor access control, data loss, misconfiguration, and weak change management can all create ICT risk.
In cyber security, ICT risk matters because most modern attacks exploit the way systems are connected and operated. An attacker may steal credentials, disrupt services, tamper with logs, or move through linked applications until critical processes fail. Defenders reduce ICT risk with layered controls such as asset inventory, identity and access management, monitoring, backups, segregation of duties, and incident response testing. In regulated sectors like banking, frameworks such as DORA and BCBS 239 treat ICT risk as a governance issue as well as a technical one, because resilient operations depend on reliable data, clear ownership, and controlled technology change.