Instead of "severity 3, likelihood 4": expected annual loss in euros
Nobody knows the frequency of a ransomware incident to two decimal places. But every responsible person can say: not rarer than every 20 years, every five years is realistic, more than once a year would be a surprise. The module takes exactly these three statements, plus three values for the loss per event, and computes with the uncertainty instead of rounding it away: a Monte Carlo simulation plays through 10,000 years and delivers the distribution of annual loss. The result is not "severity 3, likelihood 4" but: expected annual loss 210,000 euros, below 650,000 euros in nine years out of ten, 2.3 million in the worst simulated year. That is the language in which budget, insurance and risk appetite are decided.
Every quantification has a fixed seed derived from risk and state. A report from yesterday can be repeated exactly, on any instance. Anyone wanting to see how much the numbers depend on chance recomputes with a different seed; at 10,000 iterations the ALE moves by about one percent.
Saving a quantification never changes the risk analysis. "Derive severity" is a separate step with its own permission and writes the P90 of the single loss into the financial impact dimension, not the ALE, because the matrix multiplies by likelihood itself.
Current and target give the before-and-after comparison; the effect of assigned measures is combined multiplicatively and placed as a proposal in the target state. The ROSI computes with annual costs plus one-off costs over the depreciation years, not with a gut figure.
A risk that management can read in its own currency, with a calculation an auditor can repeat.
Schedule a no-obligation demo – we will show you the module with your own use cases.
