Methods and systems for risk prioritization allow a user or organization to prioritize various risk items using a knowledge base. The knowledge base may be continually updated and/or improved based on newly available historical data (e.g., cost of mitigation, actual effects), new forecasts or predicative analyses (e.g., costs for mitigation), expert community consensus and/or new priority information. As new information is updated in the knowledge base, new and existing risk items may be evaluated and/or re-evaluated to determine a risk priority. Risk priority may be determined based on a remediation cost score as well as a risk score. The prioritization system may further develop recommendations for prioritizing and mitigating a risk item.