This article measures and explains cost risk for IT projects compared with 22 other project types. The null hypothesis is that IT projects are not different from other projects in terms of cost risk. The thesis is falsified. IT cost risk is found to be uniquely more risky than other project types. First, we review four extant explanations of high IT cost risk: immaturity, intangibility, goal ambiguity, and stakeholder resistance. Second, we describe data to measure cost risk across 23 project types, including IT. Third, we fit theoretical distributions to the data and test for median and tail risk, showing that tail risk dominates, with IT cost risk having a fatter tail than any other project type. Fourth, we develop a taxonomy of risk based on the Pareto 1 tail parameter α, documenting that IT is uniquely risky as the only project type with α ≤ 1, indicating infinite mean and variance and, thus, infinite and unpredictable risk. Fifth, we return to the four extant explanations and conclude that, although our data do not prove the explanations, they also do not falsify them. Based on our data, we suggest two further explanations of cost risk: Bespokeness and “think-fast” decision-making, which we argue drive extreme risk and are typical of IT, with modularity and “think slow” as antidotes. Finally, we identify areas for further research.