Show uncertainty by giving risk ratings as ranges, adding a confidence note, and stating the assumptions behind them. A single score such as "High" or "$2 million" suggests more certainty than most security data supports. A range tells the reader how much room there is for the real answer to differ.
Why uncertainty is built in
NIST SP 800-30 says uncertainty is inherent in risk evaluation. Its reasons include limits on how far the future will resemble the past, incomplete knowledge of threats, undiscovered weaknesses in products, and unrecognized dependencies that lead to unforeseen impacts. It adds that uncertainty varies with the point in the system life cycle at which you assess.
So uncertainty is not a flaw in your process. Hiding it is the flaw.
Three ways to communicate it
NIST suggests expressing results qualitatively, giving ranges of values rather than single values, or using visual representations of fuzzy regions rather than points.
- Ranges. "Annual loss between 50 thousand and 400 thousand" says more than "200 thousand".
- Confidence labels. Add low, medium or high confidence next to the rating, based on the quality of evidence.
- Visual regions. On a chart, draw an area instead of a dot for each risk.
How to build a range
- Ask the estimator for a low and a high value they are very sure the true figure falls between.
- Check against evidence: past incidents, logs, test results, industry reports you have read.
- Narrow the range only when evidence supports it.
- Write down who estimated, when, and what they relied on.
Do not let one confident voice set the range for the group. Ask people to write estimates before discussing them, then compare.
Confidence notes that help
- Based on data: incident history or measurements from your systems.
- Based on expert judgment: informed opinion, no measurements.
- Based on assumption: a guess marked for follow up.
Revisit assumption based ratings first. They are the cheapest to improve and the most likely to be wrong.
What to say to executives
Keep it short: "We think this risk is between moderate and high. We are least sure about how often it happens, and we are collecting log data to firm that up." Leaders can work with a message like that. They cannot work with false precision that later collapses.
NIST also warns that rigor in quantitative assessment drops when subjective judgments are hidden inside the numbers or when uncertainty is significant. Showing the ranges keeps the judgment visible.
Quick check
Won't ranges make leaders think we do not know anything?
Usually the opposite. Honest ranges with stated assumptions build trust, and leaders see you know where the gaps are.
Can I use ranges with a color matrix?
Yes. Mark a risk as spanning two cells, or add a confidence label beside the color.
Sources
Last reviewed: 19 October 2026.
