Cyber risk quantification is software that turns a company's security findings into money: how likely a serious breach is in the next year, and what it would cost. It is often shortened to CRQ. Its answer is written in rupees, not in technical scores, so that a company's board, its finance team and its insurer can act on it.
A security team measures its work in technical terms: 3,000 open flaws, 92% of laptops patched, 14 suppliers not yet assessed. A board cannot compare these numbers with its other business risks, such as a delayed factory or a fall in the rupee. Cyber risk quantification converts them into the same unit as every other risk.
How does it work? The software collects data from the company's own tools. The vulnerability scanner sends the open flaws. Other tools report which protections are in place, such as multi-factor authentication (MFA) on every login. Third-party risk management (TPRM) sends the scores of the company's suppliers. The software combines these with data about current attacks and about past breaches in similar companies. It then estimates two numbers for each kind of attack, such as ransomware or the theft of customer data. The first is the probability that the attack happens in the next year. The second is the cost if it does: lost sales, the cost of recovery, fines and claims from customers.
Say a listed paint manufacturer in Kolkata wants to know what its cyber risk is worth. The software estimates a 9% chance of a ransomware attack that stops its factories for a week. Such an attack would cost about ₹120 crore. So the expected loss is about ₹11 crore a year. The software then tests the effect of each possible fix. Separating the factory network from the office network would cut the chance to 4%. The expected loss would fall to about ₹5 crore a year, for a project that costs ₹2 crore. The board approves the project.
The same figures are used in two other places. An insurer uses them to price a cyber insurance policy. The company's GRC platform, which keeps the register of every risk, records the figure next to the other business risks.
Cyber risk quantification is different from a cyber risk rating. A rating compares a company's score with the scores of similar companies, and some firms sell such ratings to boards and investors. Quantification estimates what this one company stands to lose. Its estimates are only as good as the data behind them, so the software shows the assumptions behind every figure.