Cyber Risk Quantification: Understanding Models & How to Address Key Challenges 

Keeping your cloud business safe has never been harder. The problem? An infinitely growing pile of risks, shoestring budgets, crunched bandwidth, and teams stretched thin. 

But there’s a solution hiding in plain sight: Cyber risk quantification. It’s the antidote to guesswork and helps you pinpoint the business-critical risks, quantify their potential impact, and prioritize accordingly.

This article delves deep into cyber risk quantification, exploring:

• What it is and how it works
• Risk scoring models to jumpstart your implementation
• Key challenges and strategies to overcome them

What is cyber risk quantification?

Cyber risk quantification is the process of measuring IT risks, financial impact, frequency of occurrence, and disruption of key business operations. The value of each quantified risk helps CISOs and IT teams to strategically manage risks and allocate resources based on a cost benefit analysis. 

“For operational plans development, the combination of threats, vulnerabilities, and impacts must be evaluated in order to identify important trends and decide where effort should be applied to eliminate or reduce threat capabilities; eliminate or reduce vulnerabilities; and assess, coordinate, and deconflict all cyberspace operations”. 

• The National Strategy for Cyberspace Operations, U.S. Department of Defense

Why is cyber risk quantification important? 

Cyber risk quantification helps security professionals in making informed decisions to prioritize threats and vulnerabilities and measure the financial impact of potential cyber threats. An objective risk language across the board helps technical and non-technical stakeholders understand your efforts and communicate their objections. 

When you use a cyber risk quantification system, it adds granularity to your process. You gain insight into various risk factors based on the location, technology, assets, and more components. 

A granular level insight helps you understand which areas to focus on and formulate a custom risk appetite that reflects challenges and opportunities unique to your business. Risk teams can use this information to protect critical assets that are prone to an attack. 

Cyber Risk Quantification Methods: Models and frameworks

A risk quantification model is a guided approach to manage and quantify risks based on your unique environment. There are many models and frameworks but today we will focus on two of the popular and widely adopted ones:

Factor Analysis of Information Risk (FAIR)

The FAIR risk model is a quantitative risk analysis framework that empowers organizations to understand the threats specific to their environment. Security and data scientists can use it to break down complex risk events into measurable factors and understand the relationship between all risk components. 

The FAIR model works by breaking down risk impact in mathematical terms by analyzing risk scenarios to estimate financial loss. It relies on probability, rather than predictive analysis associated with the high/medium/low model. In other words, you get a risk view that is more objective rather than subjective. 

For example, instead of relying on a subjective term like ‘high number of cases,’ quantifying unauthorized access attempts with a specific number like fifty provides actionable data for risk analysis.

The framework also encourages you to document the rationale and assumptions that went into the estimate. This helps to address differences in opinion regarding the outcome; you can take a step back and look into the estimates and rationales. 

The FAIR risk equation combines two parts—the loss event frequency and the loss magnitude. Each has a set of subcomponents, and the framework utilizes a top-down approach. 

Now let’s break down these two components. 

Loss event frequency is the rate at which a threat event has the probability of occuring within a given timeframe. It is driven by two factors – 

1. Threat event frequency identifies the number of times a threat actor tries to break into your infrastructure or access your assets. However, every attempt ≠ a successful event. Even if they can access your assets, they may not take action. So not every contact event results in a threat event. Similarly, not every threat event results in a loss event. 
2. Vulnerability is the probability that a threat event will result in a loss. Here, we compare the resistance strength of your assets to the agent’s threat capability. 

Loss magnitude is the probable amount of loss resulting from a loss event. 

1. Primary loss magnitude refers to the direct observable financial impact associated with a threat event that the primary stakeholder suffers. In the FAIR model, losses are always calculated from the perspective of the primary stakeholder. 
2. Secondary loss occurs when secondary stakeholders like customers, regulators, stockholders, etcetera react negatively to the primary loss which results in additional loss to the primary stakeholder. 

The advantage of the FAIR approach is that you don’t need to go beyond the layer necessary for your analysis. For example, if you have sufficient data on loss magnitude, you don’t need to drill down all the way to secondary loss magnitude. 

However, if you want to implement a control that affects the secondary loss magnitude, then you should have the data in the first place. 

NIST Risk Quantification Model 

NIST recognizes the importance of scoring risks to ensure that decision-makers have the right data. However, it also cautions users against using risk assessment results as an accurate measure due to the limitation of tools, reliability of the data used, and expertise of the individuals involved in the process. 

NIST 800 30 Guide for Conducting Risk Assessments guides organizations in determining the likelihood of a threat occurring and its impacts. 

It uses a combination of qualitative and semi-quantitative values to score your risks based on the adversary’s capabilities, intent, and target. 

Qualitative values	Semi quantitative values		Adversary capability	Adversary intent	Adversary target
Very high	96-100	10	Has sophisticated expertise level and is highly resourced. Capable of launching multiple, coordinated, and successful attacks.	Aims to severely undermine and impede the key operations and infrastructure to the extent that the entity cannot complete its goals.	Targets specific organizations, enterprises, programs, business-critical functions, and high-value information systems/ employees/ supply flows/ resources.
High	96 – 100	8	Also has a high expertise level and significant resources. Can launch multiple, coordinated, successful attacks.	Aims to undermine and impede critical business functions while avoiding being detected by staying within the systems and infrastructure. This way they can easily plan for future attacks.	Targets specific organizations, enterprises, business-critical functions, and high-value information systems. They also target employees or key positions supporting these functions.
Moderate	80 – 95	5	Has access to a moderate level of resources. Capable of launching multiple successful attacks.	Aims to access or modify targeted or specific system components while avoiding detection. Attempts to establish a foothold inside the systems and willing to impede critical operations to achieve their ends.	Analyzes publicly available information to target high-value businesses, programs, information, or key positions like CISOs.
Low	21 – 79	2	Holds a limited expertise level. Has access to a limited amount of resources to launch multiple attacks successfully.	Aims to access critical and sensitive information or disrupt the functions of the system’s cyber protection capabilities without disclosing themselves.	Leverages publicly available information to target a specific class of high organizations or data. They seek opportunities within that class of data or organization.
Very low	5 – 20	0	Level of resources, expertise, and opportunity is limited.	Aims to disrupt or deface the cyber protection capabilities without disclosing themselves.	May or may not target any organization or class of organizations.

Once you have the adversary scores, rate the likelihood of a threat translating into an event and the level of impact of the incidents. 

Qualitative values	Semi quantitative values		Likelihood/ rate of threat event occurrence	Impact if threat event is successful
Very high	96 – 100	10	Almost certain to occur. Rate of occurrence is 100+ a year	Multiple/ severe/catastrophic adverse effects on operations and assets.
High	80 – 95	8	Highly likely to occur. The rate of occurrence is 10 – 100 times a year.	Severe/ catastrophic adverse effects on operations and assets. The results include inability to continue business-critical operations, major financial loss, serious asset damage, or loss of life/life-threatening injuries.
Moderate	21 – 79	5	Somewhat likely to occur. Rate of occurrence is 1 – 10 times a year.	Severe or adverse effects on business-critical operations and assets. Examples include a significant reduction in ability to continue key operations, significant damage to assets, and significant but non-life-threatening harm to individuals.
Low	5 – 20	2	Unlikely to occur. Rate of occurrence is less than 1 each year and more than 1 every 10 years.	Limited adverse effect on operations and assets. The organization is able to continue key operations but the ability is noticeably reduced, suffers minor damages to assets, suffers minor financial loss, and insignificant harm to individuals.
Very low	0 – 4	0	Highly unlikely to occur. Rate of occurrence is less than once a decade.	Negligible adverse effects on the organization’s operations, individuals, and assets.

The final assessment scale is the risk matrix you get by combining the likelihood of threat occurrence and the level of impact. 

Impact level if threat event is successful	Level of impact
	Very low	Low	Moderate	High	Very high
Very high	Very low	Low	Moderate	High	Very high
High	Very low	Low	Moderate	High	Very high
Moderate	Very low	Low	Moderate	Moderate	High
Low	Very low	Low	Low	Low	Moderate
Very high	Very low	Moderate	Very low	Low	Low

How to implement cyber risk quantification

Having helped thousands of companies proactively quantify the impact of their infosec risks, here are our learnings to help you implement cyber risk quantification practices: 

• Get everyone on the same page: To establish an effective risk quantification program, all involved parties – risk teams, external stakeholders, and even high value prospects. When you have a common risk language across the board, it helps you avoid friction over key decisions in the future and ensure transparency. 
• Update as and when needed: As your business scales or if you implement any major changes in the technology stack, it inevitably adds risks to the environment. A period risk assessment and quantification adds resilience to your risk program and reduces the chance of overlooking security risks. 
• Prepare for the worst: While estimating the loss from a threat event, calculate the impact value by taking the worst case scenario into account. Doing this helps to prepare for an actual event and recover from its damages. 
• Plan ahead: This may sound basic and a little cliche, but many businesses find themselves in a cesspool due to poor or no planning. Quantifying risks is a huge project – an undertaking of this magnitude inevitably disrupts other functions, processes, workflows, and introduces minor disruptions in normal operations. 
• Document your efforts: Maintain an audit trail of your efforts from start to finish. Documentation is not just a regulatory compliance checklist – you can use these as reference to investigate failures if something does not work as intended. 

Benefits of cyber risk quantification

Quantifying cyber risks aids in making better decisions, helps to comply with regulatory requirements, and meet stakeholder expectations better. 

Let’s break them down. 

To make data-backed decisions 

As your organization scales, more processes, technologies, and people are added to the infrastructure every day, thereby increasing the attack surface. The greater the attack surface, the higher the vulnerabilities and, ultimately, the chance of breaches. 

Realistically, it is impossible to mitigate or reduce all risks from a cost perspective. Putting a number to the risks aids security and IT administrators with the knowledge to determine which risks to accept, mitigate, transfer, or mitigate. It also gives stakeholders and executives a common language to base their resource allocation decisions on. 

To comply with regulations 

Businesses processing sensitive customer information, such as providing a service to cloud-hosted companies, often have regulatory liabilities to insulate the data from risks. 

A good example is the NIST 800 53 and 800 171, both of which require organizations to conduct risk assessments. To comply with this requirement, you must categorize the information systems based on the impact its loss can have on confidentiality, availability, and integrity using both quantitative and qualitative values. 

To meet stakeholder expectations

Regulatory frameworks are compulsory in some business cases, but many use them as a growth factor. 

An increasing trend among cloud-hosted SaaS companies is the adoption of security frameworks like SOC 2 or ISO 27001 to demonstrate that their security posture is strong enough to handle sensitive information securely. This way, security compliance becomes a growth enabler rather than an expensive burden. 

A key requirement of these frameworks is conducting risk assessments and closing the gaps. The process involves identifying critical assets and evaluating the level of risk, usually using a scoring scale of low/medium/high. Quantifying risk helps management come to common terms with stakeholders and determine the necessary steps to mitigate it. 

Challenges of cyber risk quantification

Having helped thousands of companies manage cyber risks, we compiled some of the key challenges they faced: 

1) Poor visibility: As the volumes of data processed within IT infrastructure pile up, it becomes increasingly complex for security leaders to gain actionable insights based on the risk level. This is especially true for organizations that lack the right cyber risk quantification tools and are trying to manage the processes using manual or semi-automated systems. 

2) Changing threat landscape: Malicious actors develop and launch new sophisticated attacks every day, thereby changing the risk landscape. So, risk assessment results that are valid today may be obsolete in a few months. 

3) No starting point: Leaders in small businesses and startups often struggle to understand cyber risks. Without sufficient expertise or a clear view of their vulnerabilities, they struggle to find a starting point.

4) The shift to quantitative approach: Qualitative approaches are common practice. But stakeholders prefer the quantitative approach due to their limited visibility and challenges in assessing the right actionable steps. This sudden shift in processes is complex and disruptive to business operations. 

5) Inadequate resources: Managing the risk quantification life cycle is resource-intensive and time-consuming. Most businesses don’t prioritize addressing security risks until an incident occurs, to meet regulatory obligations, or due to a stakeholder requirement. Sudden changes create the need to allocate resources without disrupting key operations. 

Overcoming the challenges of cyber risk quantification

If you are a cloud-hosted startup or even a well-established business entering the world of risk quantification, let us give you a heads up – speculating risks without the right processes and tools can leave you vulnerable and lead to misguided decisions. 

Risk management and quantification tools like Sprinto use risk intelligence to help you build true resilience and assess impact with thoughtful precision. It quantifies risks that matter to your business. 

Sprinto helps you: 

• Continuously and comprehensively monitor your risk environment, flag anomalous activities, and get actionable insights into each failing control. 
• Consolidate risk information against security risk frameworks like NIST, ISO 27001, and more into a single dashboard.
• Automate the end to end risk identification and quantification cycle to significantly reduce the time to implement controls, get compliant, and demonstrate a strong posture to prospects.
• Eliminate guesswork, tie your risks to your business’ reality, and get real-time and all-round visibility into your risk environment.
• Leverage a pre-built risk library to scope out risks, add custom risks, and assign impact scores and likelihood of recurrence. Build a thorough risk register that identifies risks unique to your business. 

• Evaluate risks based on their impact using industry benchmarks to understand actual impact rather than using guesswork to determine severity and scope out treatment plans.
• Capture the status of risks and controls using detailed and easy-to-understand reports based on real-time data. Gain a granular view of risk status, identify patterns, and make accurate data backed risk decisions. 

Sprinto can do much more. Connect with our experts today to know how we can help you. 

FAQs

What are the best practices for quantifying cyber risks?

Some of the best cyber risk quantification approaches and practices include conducting cyber risk assessments, engaging stakeholders for key decisions, continuously updating risk models, and documenting assumptions and methodologies used to determine the potential impact of cybersecurity risks. 

What are the use cases of cyber risk quantification? 

Cyber risk quantification models help business leaders make informed decisions on investments, implement the right security controls to minimize the impact of potential risks and cyber attacks. Quantitative risk frameworks also help to understand the business impact of high risk factors like non compliance and operational risks like non evaluated third parties. 

Does data analytics improve risk quantification in enterprises?

Data analytics improves the accuracy and depth of enterprise risk management and quantification using machine learning and statistical modeling techniques. This helps in analyzing large volumes of data, identifying patterns, predicting potential risks accurately, and understanding the risk appetite.