Conduct IT risk and threat assessments
How conduct it risk and threat assessments are reshaped as AGI capability advances.
The bottom line
Roughly 90% of the work in Conduct IT risk and threat assessments is information-shaped — already within reach of AI delivery. The question here is not whether it shifts, but which tasks go first and who staffs the residual.
Why: Lacking child occupations, the scalar is derived from the PCF top-level lens 'Develop and manage IT resilience and risk' and the process description. Evaluating IT assets, information security, and breach points is entirely information-based, remotely doable knowledge work, pointing to a very high digital scalar.
grounded in the economy graph · digital scalar 0.90 · digital
Related articles
No articles yet for this entity.
Recent capability events
No capability events for this entity yet.
How the work flows
Trigger: A scheduled security review, major infrastructure change, or new threat intelligence alert initiates the assessment process.
- Inventory in-scope IT assets and information systems
- Identify potential security threats and system breach points
- Analyze the likelihood and business impact of identified vulnerabilities
- Calculate and assign risk levels to each threat
- Develop mitigation strategies and security control recommendations
- Finalize and distribute the IT risk assessment report to stakeholders
Outcome: Identified IT risks and threats are documented, quantified, and paired with prioritized mitigation plans in a formal assessment report.