Abstract: Utility function was introduced into security risk area, and its inverse function is used to define absolute loss effect and relative loss effect as measure of risk. They are used to build criteria of risk rank. Absolute loss effect can measure the difference of risk between security incidents with high loss，low probability and security incidents with low loss，high probability. Relative loss effect can measure the difference of risk tolerance among organizations with different scale, but the average loss used very often can't measure these differences.

Key words: information security, risk evaluation, utility theory, loss effect