In cyber risk theory, attackers require one weakness while defenders must protect everything. Which option best reflects this concept?

• A. Attackers need one weakness; defenders must protect everything.
• B. Attackers need multiple weaknesses; defenders rely on a single control.
• C. Attackers disable all systems; defenders patch only a subset.
• D. Attackers and defenders have equal capabilities.

Answer: (A)

In cyber risk theory, the situation hinges on a fundamental asymmetry: an attacker only needs one weak point to succeed, while the defender must protect every potential entry point. This reflects the weakest-link reality of most systems—if any vulnerability remains unaddressed, it can be exploited to breach the environment. That’s why the idea that attackers require just a single weakness while defenders must blanket the entire surface best captures how risk unfolds: reducing one exploitable flaw lowers risk dramatically, but achieving perfect defense across all components is exceedingly challenging.

Think of common attack paths: unpatched software, weak credentials, misconfigurations, or exposed services can each serve as a single entry point. On the defense side, effective security relies on defense-in-depth and comprehensive controls—patch management, strong access controls, network segmentation, continuous monitoring, and incident response—because anyone overlooked weakness can become the breach point.

The other options don’t fit this reality. They imply attackers need multiple weaknesses or that defenders rely on a single control, or they misstate attacker objectives and defender practices, all of which don’t reflect how single, unaddressed vulnerabilities can undermine security and how layered defenses aim to close gaps across the entire environment.