What is the relationship between "security" and "risk"?

They are inversely related — more security means less residual risk, and vice versa.

Security and risk are two sides of the same coin: every control you add reduces risk, and the risk you choose to leave defines how "secure" you are. Since absolute security is impossible, there's always some residual risk remaining.

The practical upshot: you can't sensibly talk about being "secure" without naming the risks you've accepted. Security work is really risk reduction to an acceptable level — and "acceptable" is a business decision, not a technical one.