Where this offering fits
Cyber risk quantification supports comparing scenarios in business terms. The value lies in making assumptions explicit, not in assigning a precise-looking number to uncertain information. Confirm the current SecurityScorecard offering and the inputs available for the organisation or supplier relationship being assessed.
Architecture and rollout decisions
Choose a decision such as prioritising treatment for a critical service. Define scenario, time horizon, impact assumptions and uncertainty with business owners. Review the model’s data and sensitivity to changes. Reporting should explain ranges and limitations, with a record of who accepted the assumptions and how they will be updated.
An evaluation scenario for this offering
Use a fictional critical-service disruption scenario with business-approved assumptions for duration, operational impact and uncertainty. Enter only the inputs supported by the confirmed offering and record where judgement substitutes for measured evidence. Change one material assumption, such as the recovery duration, to see how the result changes. Ask the risk owner whether that sensitivity alters the proposed treatment decision. Preserve inputs, ranges, version and approval of assumptions. Acceptance should show an explainable comparison of options rather than endorse a precise monetary prediction whose appearance of certainty exceeds the quality of the underlying information.
Evidence to request for this scope
- Obtain the current model and input requirements.
- Review scenario assumptions with business owners.
- Test sensitivity and document uncertainty.