Skip to main content
Cyber Risk Council

Cyber Risk Quantification Report

QUANTIFY CYBER RISK IN THE LANGUAGE FINANCE ALREADY USES

Probable loss ranges that aggregate, compare, and drive decisions, so you can defend security spend with a cost-benefit case instead of a compliance checklist.

Get the report
FROM HEAT MAPS TO DOLLARS//EXPECTED ANNUAL LOSS//90TH PERCENTILE//TAIL LOSS//FAIR + MONTE CARLO//8 TO 12 KRIs//4-BUSINESS-DAY 8-K DEADLINE//RANSOMWARE SUB-LIMITS//FROM HEAT MAPS TO DOLLARS//EXPECTED ANNUAL LOSS//90TH PERCENTILE//TAIL LOSS//FAIR + MONTE CARLO//8 TO 12 KRIs//4-BUSINESS-DAY 8-K DEADLINE//RANSOMWARE SUB-LIMITS//

The problem

The heat map cannot answer the questions that decide your budget

Most organizations still communicate cyber risk through heat maps, red-amber-green dashboards, and ordinal scores. These formats tell you one risk is higher than another, but never how much higher, what the probable financial impact is, or whether a control is worth what it costs. Two organizations can place the same risk in the same red cell and face exposures that differ by an order of magnitude. When a risk committee reviews a color-coded slide, it cannot answer what the expected annual loss from a ransomware event is, what residual exposure remains after current controls, or whether the balance sheet can absorb the risk being retained.

The figures this report works from

4-day
Deadline to file an 8-K after an incident is determined material under the SEC's cybersecurity disclosure rules.
~5%
Common rule-of-thumb starting point for quantitative materiality, a convention rather than an SEC safe harbor.
8-12
The right number of key risk indicators for a board-level dashboard: more disperses attention, fewer creates blind spots.
3-point
Expected annual loss, 90th percentile, and tail loss, the summary that replaces a single misleading figure.

Get the report

Get instant access to the full report

Instant access to the full 23-page report, the complete method for turning cyber risk into defensible financial loss ranges.

Why now

Why the shift to dollars is happening now

The move to cyber risk quantification is not a vendor trend. It is a response to three concrete pressures: regulators that require organizations to assess the materiality of cyber incidents in financial terms, insurance markets that price and structure coverage on modeled loss scenarios, and boards held accountable for cyber governance under frameworks that demand more than a color-coded slide. Qualitative scores cannot be aggregated, connect to no financial threshold, and support no return-on-control-investment analysis. A probable loss range expressed in dollars is comparable, aggregatable, and actionable in a way a red cell never will be.

Inside the report

What is inside the 23-page report

Why heat maps fail the people who must act on them
FAIR, actuarial modeling, and scenario stress testing, and when to use each
The three-point loss summary: expected annual loss, 90th percentile, and tail loss
Key data inputs, their sources, and the assumptions that most distort output
How to communicate uncertainty without giving decision-makers false confidence
A four-step materiality framework, seven core KRIs with thresholds, and an evidence-acceptance table

The payoff

What you can do once you have read it

Defend security spend financially

Present control investments as cost-benefit decisions tied to probable loss reduction, not benchmarking or checklists.

Walk into renewals ready

Present a structured loss analysis and control evidence so the underwriting conversation shifts from interrogation to dialogue.

Make a materiality call under pressure

Set thresholds before an incident so your team can make a timely, documented determination inside the four-business-day window.

Brief the board in their own terms

Translate operational indicators into financial exposure, probability, trend, and residual risk that directors can act on.

The method

How the report gets you from scores to dollars

01
Replace heat maps with loss ranges
Swap ordinal scores for financial loss ranges everyone reads the same way.
02
Choose and combine your methods
Use FAIR, actuarial data, and stress testing for your maturity and data.
03
Wire KRIs into the model
Map eight to twelve key risk indicators directly to quantified loss scenarios.
04
Pressure-test coverage before binding
Review ransomware sub-limits, war exclusions, and panel vendor requirements before binding.
05
Assign a named owner
Keep the model current and tied to GRC and the insurance renewal cycle.

Grounded in

Grounded in recognized frameworks and real market dynamics

Named frameworks

Built on FAIR (Factor Analysis of Information Risk), Monte Carlo modeling, NIST CSF, CIS Controls, and ISO 27001.

Established loss-data sources

Cites Advisen, Verisk, the Cyentia Institute, the Verizon DBIR, and MITRE ATT&CK.

The SEC disclosure regime

Reflects Form 8-K Item 1.05 and 10-K requirements, with UK, EU, and Australia governance parallels.

Real underwriting dynamics

Addresses NotPetya war-exclusion litigation, BitSight and SecurityScorecard ratings, and ransomware sub-limits.

FAQ

Questions before you download

No. The report is explicit that quantification does not require perfection or proprietary platforms. It walks through methods you can run with existing GRC inputs, and describes a vCISO-led hybrid model for organizations without a dedicated risk-analytics team.

From heat maps to dollars

Get the definitive guide to cyber risk in dollars

Instant access to the full 23-page report.