What kind of risk will remain even if all theoretically possible safety measures would be applied?

Residual risk is defined as the remaining level of risk after security controls have been applied to reduce inherent risk. Even with every theoretically possible safeguard in place, some level of uncertainty and exposure cannot be fully eliminated. Risk management frameworks like NIST SP 800-39 acknowledge that residual risk is accepted by organizational leadership after controls are implemented.

Inherent risk is the level of risk that exists before any controls are applied, not the risk that remains after controls are implemented.

Impact risk is not a standard term in recognized risk management frameworks and is not used to describe risk remaining after controls.

Deferred risk is not a standard risk classification in IT security or risk management frameworks.