Risk assessment is about identifying “what could go wrong” events (i.e. risk scenarios) and determining their likelihood and impact to your organisation. While organisations may have measures in place to isolate their systems from external environments, there is still a possibility of the measures failing and external threat actors could then gain access to the systems. Hence, external threats are still relevant and need to be considered when identifying risk scenarios.