Software Architect's Handbook

Accepting the risk

Another approach would be to simply accept the risk. If the prioritization of a security threat is low based on factors such as the potential damage, reproducibility, exploitability, the potential number of affected users, and the effort it would take to mitigate the risk, it is sometimes decided to accept the risk.