How the risk numbers work

Cyberkit BowtieAZBowtieA visual model connecting causes, loss of control, barriers and consequences.Select term to see glossary evaluates risk one threat–consequence pair at a time. The calculation follows a Layers of Protection Analysis style: start with how often the initiating threat event occurs, then reduce that frequency for each independent barrier on the path.

The path formula

For one threat–consequence pair:

likelihood = threat frequency × Π (1 − barrier effectiveness)

The product symbol means “multiply the remaining probability for every barrier.” A barrier assessed at 70% effectiveness leaves a 30% chance of passage, represented as 1 − 0.70.

This multiplication assumes the barriers are sufficiently independent. If bypassing the first layer also defeats the second, treating them as two independent reductions exaggerates protection.

Estimating threat frequency

Frequency is expressed as events per year. Its evidence depends on the threat source:

• Environmental: maintenance records, outage history and comparable reliability data.
• Unintentional insider: process data, error history and expert judgement about exposure.
• Intentional insider: role access, organizational history and a carefully governed threat estimate.
• External malicious: internal incidents, sector reporting, threat intelligence and the capability of relevant actor groups.

Frequency is an estimate, not a fact discovered by the software. Record the rationale and revisit it when exposure, architecture or threat intelligence changes.

From strength and maturity to effectiveness

Barrier effectivenessAZBarrier effectivenessThe estimated chance that a barrier interrupts its stated path.Select term to see glossary answers a path-specific question: what is the chance this barrier stops this threat under the assessed conditions?

Cyberkit derives a default from two separate judgements:

1. Inherent strengthAZInherent strengthWhat a barrier could withstand when functioning as designed.Select term to see glossary : what level of threat the capability could withstand when functioning optimally.
2. MaturityAZMaturityHow consistently a capability is implemented, governed and tested.Select term to see glossary or condition: how reliably the organization has implemented, governed and tested it.

The lookup can also depend on threat source and actor capability. A technically strong barrier operated ad hoc may be unreliable; a mature barrier designed for a lower-capability threat may still be insufficient against a sophisticated actor.

The matrices are configuration, not universal physical constants. A methodology owner should review them and record which version an assessment used.

A worked path

Assume an external threat event frequency of 5% per year and three independent barriers with effectiveness values of 10%, 30% and 45%.

0.05 × (1 − 0.10) × (1 − 0.30) × (1 − 0.45)
= 0.05 × 0.90 × 0.70 × 0.55
= 0.017325

The estimated mitigated likelihood is approximately 1.73% per year. That value is then assigned to a likelihood band and combined with the consequence impact in the organization’s risk matrixAZRisk matrixA configured scheme combining likelihood and impact into a risk level.Select term to see glossary .

From a path to a bowtie

One bowtie contains many threat–consequence pairs. Cyberkit calculates each path, then uses the highest resulting risk as the bowtie summary. This deliberately prevents several comfortable paths from hiding one unacceptable scenario.

Useful states include:

• Initial or unmitigated risk: the path before credited barriers.
• Mitigated riskAZMitigated riskThe assessed risk after currently credited barriers are applied.Select term to see glossary : the path with currently assessed barriers.
• Tolerable risk: the acceptance threshold set by the organization.
• Residual gap: the difference between mitigated and tolerable risk.

The same organizational risk matrix used for other business risks is usually the best reference point. It keeps cyber decisions comparable with safety, financial and operational decisions.

What the result does not prove

A calculated percentage can look more precise than the evidence. The output inherits uncertainty in threat frequency, independence, maturity, impact and the effectiveness matrices.

Use the numbers to:

• compare paths consistently;
• expose which assumptions drive the result;
• test sensitivity to a changed barrier or maturity level; and
• prioritize evidence gathering and improvement.

Do not use them to claim certainty about the next incident. A defensible assessment shows its assumptions, owners and review date alongside the result.