Platform · Decide and prove
Risk quantification
A security report full of red and amber squares cannot tell a board how much to spend, or what to spend it on first. Risk quantification puts a dollar figure on exposure, so leadership has a number it can plan a budget around and defend to the people it answers to.
The concept
Risk quantification is the practice of expressing security risk in money. The recognized standard for it is FAIR, short for Factor Analysis of Information Risk, maintained by The Open Group as the international standard for quantifying information and operational risk in money. FAIR works by breaking a risk into two questions: how often a loss event is likely to happen, and how much it would cost when it does. The range of one multiplied by the range of the other gives a probable financial loss, stated as a range so the uncertainty stays visible.
A figure on its own can feel arbitrary, so Verskop pairs it with the attack narrative behind it, described in MITRE ATT&CK terms. A reader sees the size of the exposure alongside the path an attacker would take to realize it, so a leadership team has something concrete to reason about.
Where the industry falls short
Security has a long habit of reporting risk in colors and grades. A finding gets labeled high or medium; a dashboard glows somewhere between red and green. These are easy to produce, and they carry two weaknesses. They are subjective, so two analysts looking at the same issue can grade it differently, and they have no financial grounding, so a red square cannot answer the question a budget owner is asking: what the exposure would cost, and whether the fix is worth the money.
A colored grid can look precise without a real basis for it. When risk is not stated in money, it is hard to compare one security investment against another, and the board has no figure to judge the spending by. A dollar figure can be weighed against the cost of the fix and against the other demands on the same budget.
The Verskop difference
Exposure in dollars, counted once.
Verskop puts a FAIR-based dollar figure on the exposure it has proven, and it is careful about how that number is built, because a figure a board acts on has to be one it can trust.
FAIR takes two questions, how often a loss happens and how much it costs, and produces a dollar figure a board can weigh against the price of the fix. Verskop states it as a probable range, so the figure never claims more precision than the evidence supports.
Counted by asset, never inflated
Verskop aggregates loss by asset. When one host has many related flaws, they roll up into the single exposure that host represents, so the figure reflects what an attacker could cost the business. The math is meant to hold up under inspection.
- Loss aggregated per asset, with duplicate findings rolled into one exposure
- The headline figure reflects real exposure a board can inspect
Only what was proven feeds the figure
The dollar exposure is built from confirmed findings alone. Anything still in the assessed tier stays out of the number until it is verified, so the figure at the top of the brief rests on exposure that was actually observed, with everything behind it traceable to evidence.
- Confirmed findings feed the figure; assessed items stay out until checked
- Every dollar traces back to an observed exposure
The figure comes with its story
A figure means more when the reader can see where it came from. Verskop pairs the exposure with the attack path that produces it, written in MITRE ATT&CK terms, so leadership sees how an attacker would exploit the weakness to cause a loss. The figure and the narrative appear together, so a non-specialist can follow the reasoning to the number.
- Every figure paired with the ATT&CK attack path behind it
- Written so a non-specialist can follow it to the number
The standards this rests on
Every figure above is sourced. The only claim that is ours is what Rampart Cybersecurity LLC and Verskop do.
See it on your domain
Put a number on what you are protecting.
Point Verskop at a domain you authorize, and we will show you the exposure in dollars, with the attack path behind every figure.