f the probability of some attack

increases while the consequences of that same attack decrease, a security

engineer can quantitatively calculate the effects on overall risk as follows:

$1$ point

The engineer probably cannot make a reliable calculation.

Risk decreases, because probability is a less intense factor.

Just calculate two different risk values and take the average.

By calculating risk using a common scale, simple arithmetic can be used.

Risk increases, because probability is a more intense factor.