Quantitative Risk Analysis Suite

What Is Quantitative Risk Analysis

Quantitative risk analysis assigns numerical values — dollar amounts, probabilities, and expected losses — to security risks, enabling data-driven decisions about security investments. Unlike qualitative risk assessment (which uses subjective scales like High/Medium/Low), quantitative analysis calculates the expected monetary impact of threats, allowing direct comparison between the cost of security controls and the losses they prevent.

The FAIR (Factor Analysis of Information Risk) framework is the most widely adopted quantitative risk analysis model in cybersecurity. It decomposes risk into measurable factors: threat event frequency, vulnerability, and loss magnitude, producing dollar-denominated risk estimates that executives and boards can act on.

Key Formulas

Metric	Formula	Description
SLE (Single Loss Expectancy)	Asset Value x Exposure Factor	Expected loss from a single incident
ARO (Annualized Rate of Occurrence)	Historical frequency or estimated probability per year	How often the threat is expected to occur
ALE (Annualized Loss Expectancy)	SLE x ARO	Expected yearly loss from a specific threat
Risk Reduction	ALE (before control) - ALE (after control)	Annual savings from implementing a control
ROI	(Risk Reduction - Control Cost) / Control Cost	Return on security investment

Example Calculation

Factor	Value
Asset value (customer database)	$5,000,000
Exposure factor (data breach)	40%
Single Loss Expectancy	$2,000,000
Annualized Rate of Occurrence	0.2 (once every 5 years)
Annualized Loss Expectancy	$400,000/year
Proposed control cost (DLP system)	$150,000/year
Risk reduction with control	70%
Residual ALE	$120,000/year
Annual savings	$280,000/year
ROI	87%

Common Use Cases

• Security budget justification: Present quantified risk reduction to executives to justify security spending with concrete ROI calculations
• Control prioritization: Compare the cost-effectiveness of different security controls by calculating risk reduction per dollar invested
• Cyber insurance: Calculate expected losses to determine appropriate cyber insurance coverage levels and evaluate policy cost-effectiveness
• Regulatory compliance: Frameworks like NIST CSF and ISO 27005 recommend quantitative risk assessment for mature security programs
• Board reporting: Translate technical risks into financial terms that board members and executives can understand and act on

Best Practices

1. Use ranges, not point estimates — Risk factors are uncertain. Use probability distributions (Monte Carlo simulation) rather than single values to produce realistic confidence intervals.
2. Start with your highest risks — Apply quantitative analysis to your top 10-20 risks first. The precision of quantitative methods is most valuable for high-impact decisions.
3. Base estimates on data — Use industry breach cost reports (Verizon DBIR, IBM Cost of a Data Breach), internal incident history, and threat intelligence to ground your estimates in evidence.
4. Account for indirect costs — Direct costs (remediation, notification) are easy to estimate. Include indirect costs: reputation damage, customer churn, regulatory fines, and litigation.
5. Update regularly — Risk factors change as your environment evolves. Recalculate quarterly or after significant changes to assets, threats, or controls.