Quantitative risk (FAIR-informed)

A qualitative risk matrixAZRisk matrixA configured scheme combining likelihood and impact into a risk level.Select term to see glossary answers “how severe is this scenario relative to our categories?” Quantitative analysisAZQuantitative riskRisk expressed using numerical frequency and loss estimates.Select term to see glossary asks a different question: “how often might loss occur, what range of loss could result, and how does an improvement change the expected exposure?”

Cyberkit’s optional quantitative layer is FAIR-informed. It reuses the path frequency already calculated by the bowtieAZBowtieA visual model connecting causes, loss of control, barriers and consequences.Select term to see glossary and combines it with a range of financial loss for each consequence.

Reusing loss-event frequency

The mitigated threat–consequence frequency is the model’s estimate of how often that loss event occurs. Chained bowtiesAZChained bowtieA bowtie whose outcome feeds a risk path in another bowtie.Select term to see glossary can supply the frequency from upstream scenarios.

This avoids maintaining one frequency for qualitative analysis and another for financial analysis. It also means all earlier assumptions—threat estimates, effectiveness, maturityAZMaturityHow consistently a capability is implemented, governed and tested.Select term to see glossary and independence—flow into the quantitative result.

Estimating loss as a range

For each consequence, enter three points:

• Minimum: a real occurrence with a relatively light outcome.
• Most likely: the best central estimate under the stated scenario.
• Maximum: a credible severe outcome, not an unlimited worst imaginable case.

A PERT-style estimate gives more weight to the most likely value:

expected loss per event = (minimum + 4 × most likely + maximum) ÷ 6

The range matters more than false precision in any one value.

Expected annual loss

At its simplest:

expected annual loss = loss-event frequency × expected loss per event

If a path occurs at 0.02 events per year and the expected loss per event is €1.5 million, its expected annual loss is €30,000.

This is a long-run decision metric, not a budget forecast. The organization may experience no loss for years and then a loss far above the annual expectation.

Loss-exceedance curves

Monte Carlo simulation repeatedly samples frequency and loss ranges to estimate the probability that annual loss exceeds different amounts.

A loss-exceedance curve can support statements such as:

The model estimates a 10% chance that annual loss exceeds €800,000.

That view often communicates tail risk more honestly than one expected value. It also makes the range and confidence of inputs visible.

Calibrating estimates

Three habits improve the analysis.

Use ranges you can defend

Treat minimum and maximum as a confidence interval. If the team is not reasonably confident that the result falls within the range, widen it. Wide and honest is more useful than narrow and unsupported.

Decompose the loss

Estimate components before the total:

• service interruption duration × operational cost per hour;
• recovery labor and specialist support;
• replacement or restoration cost;
• contractual or regulatory exposure;
• customer remediation; and
• secondary business effects.

The decomposition makes disagreements specific and helps identify evidence.

Use references

Past internal events, sector reports, insurance information, supplier estimates and documented regulatory rules are better anchors than an unaided workshop guess. Record the date, scope and normalization applied.

Connecting money to the roadmap

The roadmap can recompute expected annual loss after a candidate improvement. Comparing the reduction with implementation and operating cost creates a business-case input:

raise access governance to Managed
estimated annual-loss reduction: €95,000

The number does not decide automatically. Safety, legal duties, risk appetite and strategic dependency may justify action even when a simple financial comparison does not.

Honest limits

• Some consequences, especially safety and public trust, resist meaningful monetization.
• Correlation and common-cause failures can make simple portfolio aggregation optimistic.
• Sparse incident data creates wide uncertainty.
• A model result is not an accounting provision or promise of avoided loss.

Keep the qualitative impact alongside the quantitative estimate. Use the financial view to compare assumptions and options—not to hide judgement behind a currency symbol.