When working with execs and non-security folks, we often need to illustrate (and sometimes demonstrate) the risk of doing, or not doing, something. But what is risk exactly?