Risk is a range, not a score. Expressed in euros, the unit the rest of the strategy is weighed in.
Key challenges
Your risk picture reaches the board as a red-amber-green matrix. But a colour does not rank risk, and the investment behind it cannot be defended.
90%
of risk-pairs cannot be ranked unambiguously
A qualitative matrix cannot unambiguously compare the large majority of arbitrary risk-pairs, and can place a smaller risk above a larger one. It is a useful means of communication, but it says nothing about how much.
Cox, What's Wrong with Risk Matrices, Risk Analysis (2008), peer-reviewed.
64%
board alignment with the CISO
You bring maturity scores and incident figures, the board wants strategic trade-off and investment efficiency. Two units for the same problem. Board alignment with the CISO fell from 84 to 64 per cent.
Proofpoint Voice of the CISO 2025, n=1,600.
80%
of incidents despite a tool that should have stopped them
A green patch or maturity percentage does not say whether the exposure has shrunk. The large majority of incidents happen despite a tool that should have stopped them, so what counts is whether the control works, not whether it exists.
Order of magnitude; Nagomi 2025, vendor research.
Regulators and leadership do not ask what colour the risk is. They ask whether enough is being done, what the trade-off is, and in what order of magnitude we are exposed. That is the difference between a colour on paper and a substantiated range a regulator and an insurer will accept.
The difference
Not whether you score risk, but whether you express it in ranges and scenarios with assumptions you can question, and whether it makes a decision sharper.
Likelihood and impact scored subjectively from 1 to 5, plotted on a matrix. Not comparable between scenarios and not weighable against the rest of the strategy.
Loss as a range per scenario, in the same unit the board weighs everything else. Not all or nothing, but a trade-off between scenarios.
A figure that lends an air of precision, or a shock figure without a range. The assumptions beneath stay invisible and cannot be tested.
An informed estimate with a range, a confidence level and explicit assumptions. Not the truth, but traceable and defensible at the board table.
Effectiveness is measured by whether a measure is in place. What the measure removes in financial terms stays unanswered.
We translate the coverage, capability and reliability of your controls into financial impact, so you compare two investments on what they actually remove.
The number becomes the goal. A report of figures the CISO still has to translate upward, that makes no choice sharper.
We model to sharpen a choice: which investment removes the most exposure, what can wait, what is the trade-off. The number is a means.
How it works
On the left, what goes into the quantification; in the middle, the order that diagnoses and defends; on the right, what you keep. Your existing risk register and reporting stay in place.
The distinction
The sharpest trap of this domain: rolling out a platform or a FAIR model and making the number the goal, instead of starting from which decision it must support.
So our architects start at the diagnosis. Not which model we run, but which risks in financial terms really matter and which choice the number makes sharper. The model is a way of thinking, not an offering.
Your existing risk register and reporting stay in place. We decide which risks matter in financial terms, express them in ranges with assumptions, and keep it repeatable. A model is a means, not an end.
You get our expertise without building a model and a method yourself. We run the cadence; the decisions on accepting, mitigating or transferring and the ownership stay with you.
The market delivers a report the CISO has to translate upward alone. The same senior who builds the number discusses it with the board and the CFO and defends the assumptions.
Get started
Not a months-long modelling project. One conversation in which we decide which risks really matter in financial terms, and whether your current risk picture gives the board a trade-off or only a colour.
Plan a conversation
