Vulnerabilities show where your organization is exposed. Cyber Risk Quantification helps you understand the impact of that exposure on the business and creates a common language between security, risk, finance and executive leadership.
Eagle connects technical context, risk scenarios, business impact and treatment decisions to turn security data into risk intelligence.
Number of vulnerabilities, severity, CVSS, vulnerability age, SLA and technical criticality remain important. On their own, they are not enough to determine business impact.
Traditional approach
Vulnerability
CVSS
Priority
Fix
Risk-based approach
Vulnerability
Likely exploitation
Asset
Business process
Risk scenario
Impact
Treatment
Economic approach
Exposure
Risk scenario
Financial loss
Treatment
Risk reduction
Investment decision
The goal is not to fix everything first. It is to reduce the right risk first.
Concept
Cyber Risk Quantification
Cyber Risk Quantification is the discipline of representing cyber risk scenarios using quantitative metrics and, when appropriate, financial estimates.
Instead of stopping at high, medium or low, quantitative risk analysis asks how often an event is likely to happen and how much it may cost — and records how confident the estimate is. The analysis may consider:
CRQ does not eliminate uncertainty. It makes uncertainty explicit, measurable and useful for decisions.
Method
FAIR and quantitative risk analysis
FAIR — Factor Analysis of Information Risk — provides a structure for breaking risk down into loss event frequency and loss magnitude. It is maintained as an open standard, Open FAIR, by The Open Group.
Loss event frequency
How often a loss event is expected to occur, combining how often a threat acts against an asset and how likely that action is to succeed.
Loss magnitude
How much each event may cost, including primary losses and secondary losses that come from the reaction of customers, regulators and the market.
Eagle is not presented as FAIR-certified, nor as formally compliant with the standard. Its risk model organizes scenarios, assets, threats, controls, likelihood and impact — context that is conceptually compatible with quantitative approaches inspired by models such as FAIR.
Quantitative indicators
Indicators that speak the language of finance.
Annual Loss Expectancy — ALE
An estimate of the financial loss expected over a given period.
Value at Risk — VaR
An estimate of the loss associated with a given confidence level and time horizon.
Loss Exceedance
The probability that a given loss will be exceeded.
Financial Risk Exposure
A consolidated representation of the financial exposure associated with risk scenarios.
Applying these indicators depends on the methodology, the quality of the data, the assumptions used and the maturity of the risk process.
From vulnerability to financial risk
From cyber exposure to financial impact. From risk to executive decision.
Eagle seeks to connect technical signals and business context so that vulnerabilities are not analyzed in isolation.
01AssetWhat has value to the business.
02Attack surfaceHow it can be reached.
03ThreatWho can act, and with what capability.
04VulnerabilityThe weakness that can be exploited.
05Risk scenarioWhat can happen, and how.
06Business consequenceProcesses and objectives affected.
07Financial exposureThe consequence expressed in money.
08TreatmentMitigate, transfer, avoid or accept.
09Residual riskWhat remains after treatment.
Which asset is exposed?
Which risk scenario could this exposure materialize?
What consequence could it have for the business?
Risk-Based Vulnerability Management
Prioritize vulnerabilities by the risk they represent
A modern approach to vulnerability management can consider:
The three layers describe a maturity path. Eagle’s risk architecture creates the foundation for incorporating quantitative risk models and the economic analysis of treatments; financial quantification and ROSI are presented here as an evolution of the model, not as current features.
This view builds a bridge between CISO, CRO, CFO, CEO and the Board.
Eagle
An integrated view of Enterprise Risk Intelligence
Cyber Risk Quantification depends on context that already lives in different modules of the platform.
Cyber Risk
Scenarios, assessment, treatment, inherent and residual risk.
The capabilities shown may vary by environment and contracted scope.
Audiences
A common language for security, risk and business
The question each role needs answered.
Role
Key question
CISO
Which risks should be prioritized?
Vulnerability Manager
Which vulnerabilities actually change our exposure?
CRO
Are we within the defined appetite and tolerance?
CFO
What is the financial exposure, and where should we invest?
CEO
Which processes and objectives are threatened?
Board
Is the organization reducing the most relevant risks?
CRQ is not CVSS converted into money
Quantifying risk requires context.
A technical score has no deterministic financial relationship. Converting CVSS, EPSS or vulnerability counts directly into monetary values creates a false sense of precision.
Apparent precision is not the same as confidence in the decision.
Governance of estimates
Quantification with traceability
Quantitative estimates should make it possible to record:
Data source
Assumptions
Owner
Assessment date
Methodology
Confidence level
Ranges
Rationale
Changes
Approval
The value of quantification lies not only in the final number, but in the ability to explain how it was obtained.
Frequently asked questions
About Cyber Risk Quantification.
It is the discipline of representing cyber risk scenarios with quantitative metrics and, when appropriate, financial estimates, such as likely event frequency and loss magnitude.
CRQ stands for Cyber Risk Quantification: expressing cyber risk in quantitative terms so that it can be compared, prioritized and discussed with finance and leadership.
Traditional vulnerability management tends to prioritize by technical severity. Risk-Based Vulnerability Management adds likelihood of exploitation, exposure, asset criticality, business context and existing controls to decide what to treat first.
CVSS measures the technical severity of a vulnerability. EPSS estimates the probability that it will be exploited. Risk combines these signals with the asset, the threat, the controls in place and the impact on the business.
FAIR, Factor Analysis of Information Risk, is a model maintained as an open standard by The Open Group that breaks risk down into loss event frequency and loss magnitude.
Annual Loss Expectancy is an estimate of the financial loss expected from a risk scenario over one year. Its reliability depends on the data and assumptions used.
Return on Security Investment compares the expected reduction in losses with the cost of a security investment: expected loss reduction minus investment cost, divided by investment cost.
Not necessarily. CRQ can complement qualitative and semi-quantitative methods, which remain useful for initial triage and for scenarios with little data.
Not directly. Vulnerabilities need to be related to scenarios, threats, assets, frequency and impact. Converting CVSS or vulnerability counts directly into money creates false precision.
Inherent risk is the risk before considering the effect of controls. Residual risk is what remains after controls and treatment are applied. It is never zero.
It expresses exposure in terms comparable to other enterprise risks, supports budget and insurance discussions and shows whether investments are reducing the most relevant risks.
Yes. Third-party scenarios, such as the outage of a critical supplier or a data breach at a partner, can be analyzed with the same frequency and impact logic.
Yes. Comparing the expected risk reduction of each alternative with its cost helps decide where an investment reduces the most risk.
Enterprise Risk Intelligence
Turn cyber risk into decisions.
See how Eagle connects exposure, risk, controls and business context to support risk management that is more quantitative, explainable and decision-oriented.
