The biggest risk of an ICO is that it's a scam. Due to the large amount of scams that even manage to get high scores in ICO sites such as ICOBench, you really need to do indepth due diligence to try and find if they are a legitimate startup.

The other risk is that they may not be solving a problem worth solving, or their tokenomics may be really bad so that their success doesn't correlate in an increase of their cryptocurrency. Due to this, the investor really needs to know how to research whether their value proposition is strong, and whether the token is inter-woven into the company so much so that the price will increase as the Startups product is more widely used.