All of the following are examples of real security and privacy risks except:

Concept: A security risk is any agent or event that can compromise the confidentiality, integrity or availability of a computer system or the data it holds. A privacy risk is any agent or event that exposes or misuses a person's personal information without consent. Something therefore qualifies as a real security and privacy risk only when it can itself cause one of those compromises; merely being unwanted, intrusive or wasteful of resources is not enough.

Application — test each listed item against that definition:

• Hackers — reach systems and data without authorisation, so they directly break confidentiality and integrity, and can expose the personal records held on those systems.

• Viruses — malicious code that attaches to a host program or file and replicates on execution, altering or destroying programs and data, so they directly break integrity and availability.

• Identity theft — acquisition and fraudulent use of another person's personal identifiers, which is a direct breach of that person's privacy and of the confidentiality of their personal data.

• Spam — unsolicited bulk electronic messages sent indiscriminately, usually to advertise. It consumes storage, bandwidth and attention, but the message by itself neither obtains unauthorised access, nor alters data, nor discloses personal information.

Cross-check — map each item to what it actually compromises:

Three of the four map onto a definite confidentiality, integrity, availability or privacy compromise. Spam maps onto none of them, so spam is the item that is not a real security and privacy risk.

Note: spam is often the delivery vehicle for phishing links or virus-bearing attachments. In those cases the risk comes from the phishing attempt or from the malware carried, not from the unsolicited message itself, which is why standard classifications list spam as a nuisance alongside, rather than among, security and privacy risks.