One framework, the whole estate

The same loss-event model covers all three security domains.

The loss-event logic applies whether the threat is a hacker, an insider, or a forced door. Quantify it all on one comparable scale.

Ransomware, intrusion, data breach, DDoS — the classic cyber loss events, modelled with telemetry or expert ranges.

Insider threat, social engineering, fraud and coercion — human risk on the same probability-of-loss footing.

Intrusion, theft, sabotage, and site disruption — protection strength versus threat capability, quantified.

How it works

From expert judgement to a defensible loss estimate.

Three steps, transparent arithmetic, results you can put in front of a board.

Score threat frequency and capability, and how strong your protection is. Use telemetry where you have it, calibrated expert ranges where you don't.

A Monte Carlo engine samples lognormal loss magnitudes across tens of thousands of simulated years, including conditional secondary losses.

Read expected annual loss, value-at-risk, and the exceedance curve. Compare scenarios, test controls, and prioritise spend.

What the model provides

Threat capability and protection strength compete as paired strengths — a screening estimate from two numbers.

Laplace's Rule of Succession when you have history; Beta-PERT with tunable confidence when you don't.

Lognormal loss distributions over 10k–100k iterations, producing a full annual loss distribution in the browser.

See the probability of exceeding any loss threshold, with VaR at the 90th, 95th and 99th percentiles.

Model fines, churn and reputational fallout as conditional secondary losses with their own distribution.

Every run exports a summary sheet and a full per-iteration simulation table for offline analysis or audit.

The core idea

·
Decompose every loss event into how often a threat is attempted and the chance your protection fails.
·
Count attempts, not incidents — the model is explicit about the bias that double-counts protection.
·
Built-in limitations are documented, not hidden — the model is a screening and prioritisation tool, not a substitute for rigorous probabilistic analysis.

Loss event probability

P(loss) = F × T/(T+P)

FFrequency — annual probability a threat event is attempted.

TThreat strength — capability of the adversary, 0 to 1.

PProtection strength — strength of your controls, 0 to 1.

Give every risk scenario a number you can defend, compare, and act on — in a browser, with no proprietary tools.