Cybersecurity risk management usually depends upon a risk analysis that calculates cybersecurity risks based on the generic risk equation that states that:

Cyber risk = Consequence of attack x Likelihood of attack

The math behind this calculation tends to be fluid and prone to subjective interpretation because each component is comprised of many variables that are often difficult to measure quantitatively.

For example, consequences of an attack can include impacts to significant business objectives, regulatory impacts, customer churn, and so on. The severity scoring of these potential consequences is also interrelated with the value of the impacted asset to the business mission, business process, or to the customer.  Meanwhile, the likelihood of an attack can be influenced by a number of variables such as the attractiveness of an asset to attackers, the vulnerabilities present in the asset, and the existing controls or countermeasures around the asset.

While coming up with risk calculations is never a precise science, engaging in even the most straightforward modeling to calculate cyber risk provides a guidepost for taking a more disciplined approach to setting security strategy. Investments are made to drive down the overall cybersecurity risk exposure of an organization by focusing on improving controls or risk mitigations that reduce the likelihood of attack and/or minimize the potential business impacts of the highest risk threats.

This approach stands in contrast to making reactive investments based on ‘gut’ reactions to vendor marketing that fosters fear, uncertainty, and doubt (FUD) around threats that may not necessarily pose a lot of risk to the business.