Cyber risk quantification (CRQ)

Cyber risk quantification (CRQ) is the practice of expressing security risk in financial terms rather than qualitative ratings. Instead of a red cell on a heat map or a score out of ten, CRQ produces a distribution of possible losses and summary figures drawn from it, such as the expected annual loss, Value at Risk at a chosen confidence, and the conditional value at risk in the tail.

The point is comparability. A dollar figure can be summed across a portfolio, tracked quarter over quarter, weighed against the cost of a control, and placed next to market, credit and operational risk in the same board pack. CRQ does not make risk more certain; it makes uncertainty legible, by stating it as ranges and probabilities the rest of the business already knows how to read.