Source: Help Net Security
Author: Mirko Zorz
URL: https://www.helpnetsecurity.com/2026/10/08/ivan-milenkovic-qualys-cyber-risk-quantification/
ONE SENTENCE SUMMARY:
Security leaders should quantify cyber risk in money via loss-scenario models, prioritize remediation by value-at-risk, and report consistently to boards, CFOs, and underwriters.
MAIN POINTS:
- Many security metrics lack a financial anchor, leaving boards unable to assess value delivered.
- Effective models start with business loss scenarios, then map down to driving assets.
- Assign a loss range to each scenario, improving estimates with real outcomes over time.
- Prefer system-sourced inputs; distrust numbers manually adjusted or curated by humans.
- Prioritization should reflect value at risk, not technical severity scores alone.
- Compare exposures on revenue-impacting systems versus low-value assets like unused test servers.
- Board reporting should stay above CVE detail, focusing on enterprise control scaling and residual loss.
- Demonstrate “nothing happened” value through measurable changes: exposure windows, overdue risk, tested controls.
- CFOs expect spreadsheet-ready ranges, likelihoods, spend options, and consequences of inaction with an owner.
- A single underlying model can serve board decisions and insurance underwriting with different evidence depth.
TAKEAWAYS:
- Reverse the usual approach: model losses first, then trace vulnerabilities to business impact.
- Use value-at-risk to depoliticize remediation decisions and justify resource allocation.
- Prove prevention by tracking consistent, time-series indicators tied to key scenarios.
- Translate security into finance language: ranges, probabilities, and decision-linked investment outcomes.
- Align board narratives and underwriting submissions so claims-time scrutiny matches reported reality.