CYBER RISK QUANTIFICATION
Make Cyber Risk Quantification Traceable
At a Glance
Duration
Scope
Readout
Model
Operationalization
CYBER RISK QUANTIFICATION
Agreed by scenario scope
Scenario → Decision
Loss estimates & treatment comparison
GGIM Quantification
FrostLine optional
Cybersecurity investment decisions need a clear view of potential financial loss, the options for reducing it, and the uncertainty surrounding those estimates.
We quantify selected cyber risk scenarios affecting agreed business processes. We connect the analysis to supporting evidence and explicit assumptions so leadership can compare treatment options, evaluate whether to accept exposure, or identify what needs further investigation.
FINANCIAL LOSS ESTIMATES. EXPLICIT ASSUMPTIONS. INFORMED RISK DECISIONS.
RISK QUANTIFICATION |
Estimate potential financial loss for selected business scenarios.
DECISION SUPPORT |
Compare treatment options and understand which uncertainties affect the choice.
Cyber Risk Without a Financial Basis
Leadership needs to understand potential losses, how treatment could change them, and which assumptions affect the decision.
01
The Problem
A qualitative rating alone does not explain whether a proposed cybersecurity investment is economically justified, how much exposure it could reduce, or which assumptions might change the decision.
Quantification can also be difficult to defend when its inputs are disconnected from the business processes, technology, controls, and recovery conditions being modeled. Financial estimates need an understandable basis and clear limits.
02
Why It Matters
Leadership must allocate finite resources while considering business priorities, obligations, risk tolerance, and potential losses.
A useful analysis shows the range of possible outcomes, how proposed treatments could change that range, and how uncertainty affects the choice. It also identifies when obtaining better evidence is more valuable than making an immediate commitment.
The analysis connects each risk scenario to business context, evidence, and explicit assumptions, making loss estimates and treatment comparisons traceable.
See what we examine
What We Examine
The engagement focuses on selected cyber risk scenarios affecting agreed business processes and the specific decisions leadership needs to make.
01
Business objectives, process boundaries, and potential consequences of disruption or compromise.
Business Process Context
02
Scenario boundaries, affected assets and information, and the period covered by the analysis.
Scenario Definition
03
Threat context and assumptions about how frequently relevant events could occur.
Threat & Event Frequency
04
Existing controls and the evidence supporting their assumed effect on event frequency or loss.
Controls & Modeled Effect
05
Potential financial losses and the business assumptions underlying their estimation.
Financial Loss
06
Business interruption, recovery capacity, and critical dependencies affecting the extent and duration of loss.
Interruption & Recovery
07
Proposed treatments, implementation requirements, expected coverage, and implementation and operating costs over an agreed period.
Treatment Options & Costs
08
Obligations, risk tolerance, and practical constraints affecting treatment and risk acceptance decisions.
Decision Criteria & Constraints
09
Input sources, age, relevance, and uncertainty, including assumptions requiring further evidence.
Input Quality & Uncertainty
10
Scenario overlap, shared dependencies, and potential double-counting that could distort combined estimates.
Scenario Relationships
The scope defines which scenarios and losses are included. Findings apply to that scope; selected scenario estimates do not constitute a complete enterprise risk estimate.
See the questions we answer
Questions the Engagement Answers
Eleven questions guiding the quantification of selected cyber risk scenarios, comparison of treatment options, and interpretation of uncertainty.
THE RISK QUANTIFICATION QUESTIONS
11
Questions addressed through evidence, explicit assumptions, and modeled financial outcomes.
Grounded in selected scenarios and business processes
Inputs distinguished as observed, estimated, or assumed
Results interpreted against treatment costs and decision constraints
METHOD:
GGIM QUANTIFICATION PROFILE & SUPPORTING ATLAS DOCUMENTATION
The answers help leadership compare treatments, evaluate risk acceptance, and identify where further evidence could change the decision.
01
02
03
04
05
06
What financial losses could arise from the selected scenarios over the agreed period?
What range of outcomes does the model indicate, including severe-loss outcomes?
Which inputs are observed, estimated, or assumed?
Which assumptions have the greatest influence on the results?
How could each proposed treatment change event frequency or loss magnitude?
What implementation, coverage, effectiveness, or recovery assumptions support that projected change?
07
08
09
10
11
How do treatment costs compare with the modeled reduction in exposure?
How do obligations, risk tolerance, and delivery constraints affect the available options?
Could reasonable changes in assumptions change the preferred decision?
Which additional evidence would most improve confidence in the decision?
Where could overlapping scenarios or shared losses be counted more than once?
See the conceptual model
The Quantification Trace
THE GGIM QUANTIFICATION PROFILE
9
Nine connected elements, from business context to financial risk decisions.
Inputs linked to sources and explicit assumptions.
Treatment effects traced to changes in model inputs.
Comparisons made within agreed scenario and time boundaries.
Leadership can then compare modeled current exposure with projected exposure under each treatment, alongside cost, uncertainty, obligations, and implementation constraints.
Show me the trace.
Treatment comparisons are conditional estimates. They describe what the model projects if the stated treatment assumptions hold.
01
Business Context
The business process, objectives, analysis period, and decision the assessment supports.
02
Asset / Information
The assets, information, and dependencies involved in the selected scenario.
03
Threat Scenario
The defined event, how it could occur, and the business process it could affect.
04
Frequency + Vulnerability
How often relevant threat events could occur and the likelihood they result in loss.
05
Loss Magnitude
The potential financial consequences of a loss event and the assumptions behind them.
06
Loss Distribution
The modeled range and likelihood of financial losses over the agreed period.
07
Treatment Delta
The changes to model inputs expected from each treatment, with supporting evidence and assumptions.
08
Exposure Reduction
The projected reduction in exposure relative to treatment cost, compared on a consistent time basis.
09
Decision
The choice informed by current and projected exposure, cost, uncertainty, obligations, and implementation constraints.
We connect each selected business process to a defined cyber risk scenario, the conditions affecting its occurrence, and the financial consequences that could follow.
The analysis links model inputs to their sources and records the assumptions needed to interpret them. Proposed treatments are evaluated by identifying which inputs they are expected to change and the evidence supporting those expectations.
see what you receive
What You Receive
You receive quantified scenario models, traceable inputs and assumptions, treatment comparisons, and an executive brief supporting the agreed risk decisions.
1
Quantified Scenario Models
Defined scenarios, scope boundaries, analysis periods, and modeled financial loss distributions.
2
Input & Assumption Register
Sources, dates, estimation methods, rationale, and limitations for material inputs.
3
Uncertainty & Sensitivity Analysis
The inputs that most influence results and the assumptions that could change the preferred decision.
4
Treatment Option Assessment
Proposed responses, costs, implementation requirements, and assumptions supporting their expected effect.
5
Current & Projected Exposure
Current exposure compared with projected exposure under selected treatments, including residual exposure and severe-loss outcomes.
6
Evidence Improvement Priorities
Additional information most likely to resolve material uncertainty or improve the decision.
7
Executive Decision Brief
Recommended actions supported by economics, uncertainty, obligations, risk tolerance, and practical constraints, with unresolved questions requiring leadership judgment.
Where the evidence does not support a clear preference, the brief explains why and identifies what would help resolve the choice.
See how we work
How We Work
Seven steps from an agreed business decision to quantified exposure, treatment comparisons, and executive interpretation. Timing is agreed at the outset based on scenario scope, evidence availability, and stakeholder participation.
The engagement provides a point-in-time analysis based on the evidence and assumptions documented. Treatment implementation, validation of realized results, and subsequent reassessment can be scoped separately.
See how it is built on GGIM
1 |
Define the decision and scope
Agree the business processes, scenarios, options, analysis period, and boundaries relevant to the decision.
2 |
Establish the business and loss context
Work with process owners and relevant technology, security, and finance stakeholders to understand potential consequences and supporting assumptions.
3 |
Develop traceable inputs
Review available evidence, document estimates, and identify gaps or limitations.
4 |
Quantify scenario exposure
Apply the GGIM Quantification Profile and supporting Atlas documentation, using a FAIR-aligned approach to estimate loss event frequency and loss magnitude, with modeling choices and uncertainty recorded.
5 |
Model treatment alternatives
Estimate how proposed treatments could change exposure, accounting for implementation, coverage, effectiveness, recovery, and cost assumptions.
6 |
Test sensitivity and decision stability
Examine which assumptions drive the results and whether plausible changes alter the preferred option.
7 |
Deliver the executive interpretation
Present the options, projected outcomes, constraints, and recommended next steps, including priorities for obtaining better evidence.
Built on GGIM
The GGIM Quantification Profile connects financial risk estimates to business context, evidence, and explicit modeling assumptions.
Each estimate remains connected to its scenario, input sources, and modeling assumptions, providing a traceable basis for review and reassessment.
Discuss Your Cyber Risk Decision
What GGIM connects
For Each Selected Scenario
1. Business Processes & Objectives
What is at risk and which decision the analysis supports
2. Technology & Data
Which assets, information, and dependencies are involved
3. Threat & Event Conditions
What informs frequency and vulnerability estimates
4. Controls & Treatments
Which inputs they affect and why
5. Recovery & Loss Context
What informs disruption duration and financial consequences
6. Evidence & Assumptions
Where inputs came from and what remains uncertain
7. Decisions & Review Triggers
How results inform choices and when inputs need reassessment
GWS applies the GGIM Quantification Profile and its supporting Atlas documentation to quantify selected cyber risk scenarios. GGIM connects the business processes, technology, data, controls, and recovery dependencies relevant to each scenario with the inputs used in the analysis.
Within this methodology, FAIR-aligned analysis structures financial estimates around loss event frequency and loss magnitude. GGIM provides the business context and traceable relationships that explain where inputs came from and why they were used.
This allows reviewers to examine the evidence and modeling assumptions supporting an estimate and identify which inputs may need reassessment when conditions change.
Optional FrostLine Snapshot
Where appropriate, a FrostLine Snapshot can contribute point-in-time diagnostic evidence. Its role and coverage are defined within the engagement scope.
What It Looks Like and How to Reach Out
A focused engagement built around selected cyber risk scenarios and a defined business decision. Scope and timing are agreed during the initial discussion.
Discuss Your Cyber Risk Decision
Start a Cyber Risk Quantification
Tell us which cyber risk decision you are facing. We will arrange an initial discussion to explore the relevant scenarios, available evidence, and scope of analysis.
Start with a cyber risk decision: whether to fund a treatment, compare alternatives, accept exposure, or obtain better evidence before acting.
We use an initial discussion to identify the affected business processes, relevant scenarios, available information, and the decision the analysis must support.
Glacial Wolf Strategy provides governance advisory and decision support. The Cyber Risk Quantification engagement is not an audit, certification, attestation, or legal opinion.
The initial discussion covers
1
Decision to Support
What treatment, investment, or risk acceptance decision needs a clearer financial basis?
2
Business Processes and Scenarios
Which processes could be affected, what could happen, and which alternatives should be compared?
Available Evidence and Analysis Scope
What information is available, where are the uncertainties, and which scenarios, losses, and analysis period should be included?