Security is a constant negotiation between what could go wrong and what we are willing to accept. Perfect protection does not exist, so practitioners work in terms of risk and trust: judging how likely a threat is, how much harm it could cause, and whom or what to rely on. This category explores that reasoning. It belongs in the Foundation pillar because nearly every security decision is, at heart, a judgment made with incomplete information.
The topics below frame the discipline.
Risk assessment and management cover how threats are identified, measured, prioritized, and reduced to acceptable levels.
Building and placing trust in systems and people examines how trust is earned, verified, and extended, and what happens when it is misplaced.
Balancing risk against usability weighs stronger protection against the friction it adds for the people who must use the system.
Decision-making under uncertainty addresses how teams choose and act when the full picture is never available.