Risk Quantification
Replace High, Medium, and Low with loss estimates in dollars. We apply FAIR to cyber risk, and the same quantitative discipline to operational risk capital, model risk, and technology resilience, so your next decision survives the first hard question.
The problem with the heat map
A heat map says a risk is “High.” It does not say whether that means $50,000 or $50 million, how likely it is, or what a control would save. The same gap shows up elsewhere: capital set by rule of thumb, models validated against a checklist but never priced for error, and recovery-time targets that nobody has tested against losses. Boards and regulators learn to discount all of it, so risk and security investment gets questioned, delayed, or approved on gut feel.
Where we apply it
Cyber risk (FAIR)
We apply FAIR (Factor Analysis of Information Risk) to your highest-priority cyber scenarios and turn each one into a loss estimate in dollars, with the range around it. You can then compare security investments by cost against expected loss avoided, and bring the board a number instead of a color. The result is a risk or security budget decision made on figures leadership trusts.
Operational risk capital
Most investment firms and fintechs set operational risk capital with a rule of thumb or a sum of scenario estimates, and then struggle to explain it when a regulator or board asks how it was derived. We replace that with a documented capital figure built from your own scenarios: frequency and severity estimated for each, extreme losses treated explicitly, and dependence between scenarios modeled instead of assumed away. In a focused assessment of typically three to four weeks, you finish with an operational risk capital number, the range around it, and a plain-language record of every assumption, ready for your ICARA, ICAAP, or board capital discussion. The result is a capital decision you can explain line by line, not a number you have to defend from memory.
Model risk, quantified
Model validation tells you whether a model follows the rules. It rarely tells you what it costs you if the model is wrong. We put a dollar range on that. For your highest-tier models, including machine learning and AI models, we measure how much the output moves under parameter uncertainty, alternative model choices, and shifts in the data, and we translate the spread into a financial exposure your governance committee can act on. In a focused assessment of typically three to four weeks, you finish knowing which models carry the most financial risk, how large a cushion or overlay is justified, and where further validation effort will pay off. The result is model risk governance driven by exposure, so effort goes where being wrong is expensive.
ICT incident loss and impact tolerance
Regulators such as those enforcing DORA expect financial firms to estimate what major technology incidents cost per year and to set impact tolerances for critical services. Most firms answer with qualitative ratings and recovery-time targets that nobody has tested against losses. We build the estimate: incident frequency and recovery-time distributions for your critical services, translated into annual loss ranges and into the point where an outage exceeds your stated tolerance. In a focused assessment of typically three to four weeks, you finish with a loss estimate by scenario, a financial view of your impact tolerances, and a clear picture of which services drive the exposure. The result is a resilience case you can put in front of a regulator or a board, with numbers behind each tolerance instead of a target taken on faith.
What we do differently
In every area, we do the analysis ourselves rather than handing it to a subcontractor, and we follow the same five steps.
- Define the question precisely. Which asset, threat, model, or service, and which type of loss. A vague question produces a vague number.
- Estimate frequency and magnitude. How often a loss event is likely to occur, and how large the loss is likely to be, using your data, public incident and loss data, and calibrated expert estimates. Estimates are ranges, not single points.
- Simulate. Monte Carlo simulation combines the ranges into thousands of possible years and produces a loss-exceedance curve: the probability that annual losses exceed any given dollar amount.
- Test the decision. We re-run the model with the proposed control, capital buffer, model overlay, or recovery improvement in place, so you can compare options by cost versus expected loss avoided.
- Show our work. Every assumption is documented in plain language, with a sensitivity analysis showing which assumptions move the answer the most.
What you receive
- Quantified loss estimates in dollars, by scenario, model, or service, with documented assumptions
- A loss-exceedance curve for each item and for the combined portfolio
- A ranked comparison of options by cost and expected loss avoided
- A sensitivity analysis showing where better data would change the answer
- A board-ready summary and the working model, so your team can re-run it
Typical engagements
| Engagement | Typical duration | What it covers |
|---|---|---|
| Top-three scenario sprint | 2 to 3 weeks | Your three highest-priority cyber scenarios quantified with FAIR, with a board summary |
| Focused assessment | 3 to 4 weeks | Operational risk capital, model risk, or ICT incident loss and impact tolerance |
| Quantified risk register | 4 to 8 weeks | A full set of scenarios, aggregated into one portfolio view |
| Quarterly refresh | Ongoing | Re-quantification as threats, controls, models, and the business change |
Questions we hear
Do we have enough data? Usually yes. Cyber, operational, and incident loss data are often thin, and these methods are designed for that. We combine your internal records, external loss data, and calibrated expert judgment, and we show how uncertain the result is instead of hiding it.
Is this a replacement for our risk framework? No. It sits underneath your existing framework (NIST, ISO, or your own) and replaces the scoring step with numbers.
Will the number be right? It will be defensible, which is different from certain. The model states its assumptions and ranges so the board can see what the number rests on.
Do we need all four? No. Each stands alone, and most clients start with the one question that has a deadline attached.
What if DORA, ICARA, or ICAAP do not apply to us? The methods work the same way. Those rules are examples of regulators asking for exactly these estimates, and where they do not apply, the same figures support your own board, investors, or lenders.
The outcome
A risk number, whether for cyber loss, operational capital, model error, or outage impact, that survives the first hard question from your board or your regulator, because it was built to be defended, not just presented.