Cyber risk quantification (CRQ) is the process of expressing an organization’s cyber exposure in financial terms. It may estimate expected annual loss for a scenario and show a confidence interval to make uncertainty explicit. Results depend on assumptions about assets, threats, likelihood, and business impact.
CRQ helps leaders compare risks, prioritize security investments, and inform decisions such as insurance limits. In practice, a model should explain its inputs, identify which are supported by evidence versus estimates, and show how changes in assumptions affect the result. This matters because a precise-looking figure can still be misleading if its basis is opaque or outdated. Attackers do not use CRQ directly, but defenders use it to guide protection and communicate risk; it should support decisions, not be treated as a prediction or settled fact.