Strengthen your company's security posture with risk quantification

Risk professionals work with uncertainty every day. They need to identify and prioritize which risks to address now versus later, consider many moving parts and rely on judgment and data to make informed decisions.

But how do they communicate those risks to stakeholders? Using "low, medium or high" classifications doesn’t always express the consideration risk requires -- especially since those terms don’t mean the same thing to everyone. If you told key stakeholders "there’s a possibility of rain tomorrow" before a company barbecue, how would they know whether to reschedule or put a few tents up? Is "possibility" enough information to make that decision, especially since not everyone equates possibility with the same level of probability? 

Accelerated digital transformation programs, increasingly aggressive cyber threat actors, and a dispersed workforce has risk growing in all directions. How can you evolve with constantly changing trends? By using risk quantification and its common language everyone understands.

A useful tool for more efficient risk management

Risk quantification is an important tool companies can use to mitigate the financial impact of a data breach. A 2021 PwC survey found more than half of business and tech executives surveyed are increasing their companies’ cyber budgets. They’re incorporating cyber and privacy into every business decision or plan. Nearly 75 percent expect to strengthen their cybersecurity posture while containing costs.

Risk quantification offers a more rigorous approach than labeling threats as low, medium or high. What if you could get more specific instead saying there’s a 25 percent chance of snow or a 75 percent chance of snow? Communicating a calculated risk, developing a plan and getting buy-in from everyone would be a lot easier.

Translating subjective language into numbers allows everyone to visualize, understand and measure their value. Accurate, quantifiable data facilitates informed decision-making. Cyber risk quantification focuses on strategic matters and increase productivity because it:

• Assesses the potential magnitude of loss or value at risk under a specific scenario.
• Compares risk amounts to your organization’s risk tolerance.
• Enables companies to design responses more aligned to achieve the highest returns.

Need another reason to embrace risk quantification? By 2023, Gartner estimates 30 percent of CISOs’ effectiveness will be measured directly on their abilities to create business value. Risk quantification’s ability to help CISOs calculate the financial impact of their companies’ risk profiles makes it critical for decision-making. Using monetary terms to measure risk exposure also reduces ambiguity. Risk managers can shift the overall company view of risk from an obstacle to a strategic advantage.

By quantifying risk scenarios, companies become empowered to:

• Assess the potential magnitude of loss or value at risk (VaR) under a scenario
• Compare VaR to an organization’s risk tolerance
• Design their responses to achieve the highest returns

Evolving cyber threats require upping your security game

When PwC conducted a cyber-ready assessment in early 2021, US CEOs listed cyber threats as their number-one concern. Cybersecurity innovations haven’t kept up with digitization. Keeping pace with business transformations isn’t enough, either.

Where have cybercriminals increased their attacks? Pretty much everywhere. About half of the organizations participating in the PwC survey identified software updates, software supply chains and business emails as the top attack vectors for malware and phishing. Other fast-growing threat vectors include IoT and mobile technologies.

CISOs and CIOs anticipate ransomware attacks to accelerate and grow more expensive. To get started with risk quantification, organizations can use the Open FAIR™ model to define risk objectively with a clear taxonomy which, when adopted organization-wide, enables everyone to communicate about and understand risk. This heightened state of awareness improves decision-making among employees and company leadership and better protects assets in the long run. Applying Open FAIR, allows you to quantify risks by:

• Identifying company-specific risks.
• Evaluating people, processes and technology controls.
• Assessing monetary impacts of threat events that potentially materialized.
• Simulating probable outcomes.

An effective tool for identifying and weighing risk pros and cons

Risk quantification measures risk. It isn’t a Magic 8 ball, so while it does help risk managers prioritize which risks to address, it doesn’t offer suggestions on how to use the information it gathers. CISOs and other risk professionals still should use their experience, intuition and judgment based on their understanding of the company, its risk appetite, and the risks it faces.

Risk quantification’s value lies in giving companies another tool for assessing, communicating and responding strategically to risk. Quantifying different risks’ financial impacts enables companies to balance business objectives and prioritize asset protection. This approach creates the advantage of aligning risk analysis and decisions with business goals.

Perhaps the best question to ask isn’t "What would happen if my company doesn’t add risk quantification to its strategies?" but rather "How much harm am I doing if I don’t incorporate risk quantification?"

Photo Credit: Olivier Le Moal / Shutterstock

Jon Siegler is the Co-Founder and Chief Product Officer at LogicGate. He has over a decade of experience in designing customer-centric enterprise risk and compliance systems, delivering value for organizations by reducing their risk, improving efficiency, and automating processes. Jon is driven by a passion to connect deeply with our customers' problems in order to build an amazing product that makes the challenges of risk and compliance easier.