What Is Residual Risk and How Do You Mitigate It?

**Executive Summary:** This blog defines residual cyber risk—the exposure that remains after implementing controls—explains why it persists (limitations of technology, human behavior, and third-party dependencies), categorizes it into technical, human, and third-/fourth-party risks, and provides practical guidance for identification and management (risk registers, control quantification, what‑if modeling, compensating controls, dashboards, and continuous third‑party monitoring), with particular emphasis on supply‑chain and file‑transfer vulnerabilities as common sources of exposure.