Home / Risk quantification
An offer, delivered with you · not a product you switch on
Make cyber risk easier to compare, prioritise and explain.
Quantification earns its place when it supports a decision. MyRISK helps teams frame scenarios, estimate impact, record the assumptions behind the numbers, and give an investment or acceptance decision a rationale that still reads a year later.
Why now
The number is not the hard part. The reasoning behind it is.
Most quantification work fails not because the model is wrong, but because nobody can reconstruct how the figure was reached. Six months on, the scenario has moved, the assumptions are undocumented, and the decision it supported cannot be defended.
The useful version answers a question somebody is actually being asked: is this exposure worth funding, and what did we assume when we said so.
What usually prompts the conversation
- Cyber risks are hard to compare against each other
- Financial exposure is unclear
- Investment trade-offs are difficult to explain
- Assumptions are not recorded anywhere
- Risk acceptance lacks a business rationale
- Board reporting is either too technical or too generic
What the work produces
Decision-ready, and legible to whoever asks next.
Scenario definitions
The events being estimated, written so two people read them the same way.
Exposure estimates
Ranges rather than false precision, with what drives them stated.
Assumptions register
What was assumed, by whom, and what would change the answer.
Treatment options
What could be done, at what cost, against what reduction.
Board-ready reporting
The same analysis, at the altitude the audience needs.
A traceable record
The rationale, the actions and the review points, kept together.
Where it goes next
Quantification should support a decision, so it usually joins one.
If the decision has to be defensible later
An investment, acceptance or exception decision that someone may question months from now belongs in Trace, where the evidence, the authority, the conditions and the later change stay together.
If the analysis is the engagement
Scenario design, modelling and the reporting around it are consulting work, scoped and delivered with your team rather than bought as software.
Being straight about it
What this is, and what it is not.
- This is an offer, not a product. It is delivered with you, and there is no quantification module to log into.
- FAIR is a method, not a MyRISK product. Where a FAIR-style approach fits, that is how the work is framed — it is not something MyRISK sells you a licence to.
- A number is not an assurance. Quantification supports a judgement; it does not replace one, and it is not a compliance opinion.
Which decision are you being asked to justify?
Bring that one. It is a better starting point than a model.