The article discusses the importance of distinguishing between threats and risks in cybersecurity, emphasizing that while dealing with threats is necessary, true resilience against cyberattacks comes from comprehensive risk management strategies. According to Anthony Pierce from Splunk, the focus in cybersecurity has mainly been on reacting to threats, but true risk reduction involves implementing controls that address those threats. Thus, taking a risk-centric approach that includes frameworks like NIST, CSF, ITIL, and ISO can significantly enhance an organization's cybersecurity posture by mitigating risks and bolstering defenses against cyber threats, moving beyond reactive practices to a more proactive and comprehensive cybersecurity strategy
```https://www.bankinfosecurity.com/threat-versus-risk-rethinking-cybersecurity-fundamentals-a-25222