Why heat maps are losing ground
Boards now spend cyber dollars in the same conversation as capital projects, M&A and insurance. A red square next to "ransomware" doesn't tell a director whether to fund a $1.2M endpoint replacement or a $400K detection uplift. Quantification gives directors the currency they already use for every other risk on the register.
Australian regulators have accelerated this shift. APRA CPS 230 and CPS 234, the SOCI Act's board-approved CIRMP, and AICD director-duty guidance have all moved the evidentiary bar from "we have a program" to "here is the residual exposure in dollars".
The minimum viable quantification
You do not need a full FAIR program to get started. A defensible first pass covers your top five to ten risk scenarios, each expressed as:
- Loss event frequency — how often this scenario plausibly occurs per year, as a range.
- Loss magnitude — the dollar impact per occurrence, decomposed across the six loss categories below, as a range.
- Annualised loss expectancy (ALE) — the product, reported as a range with a confidence interval.
- Control modifier — the proposed investment and the residual ALE if funded.
The six loss categories every Australian board scenario should cover
| Loss driver | Example | Signal to use |
|---|---|---|
| Productivity | Business interruption during ransomware containment | Hours of downtime × loaded labour cost + revenue impact |
| Response | IR retainer, forensics, legal, comms, overtime | Vendor day rates × estimated days + retainer ceilings |
| Replacement | Rebuild of compromised systems, endpoint reimaging | Asset count × per-asset rebuild cost |
| Fines & judgments | OAIC penalties, APRA enforcement, class action exposure | Recent Australian enforcement cases, statutory penalty units |
| Competitive advantage | IP loss, M&A pipeline exposure | Internal valuation × probability of disclosure |
| Reputation | Customer churn, brand recovery spend | Cohort churn rate × LTV + brand campaign cost |
Where to source defensible Australian numbers
- Internal incident history — your own ticketing, IR retainer invoices and downtime logs.
- ACSC Annual Cyber Threat Report — sector and incident-type baselines.
- OAIC Notifiable Data Breaches report — notification volumes and root-cause distribution.
- IBM Cost of a Data Breach (Australia) — per-record and total-incident benchmarks.
- Industry benchmarks — peer associations, sector ISACs and broker loss runs.
FOR CISOs AND CIOs
Quantify a real decision in 10 minutes.
Bring your highest-stakes investment trade-off and run it through FORTE/CYBERx. You'll get a ranked decision, a tactical plan and a board-grade narrative you can take into the next risk committee.
Run a free missionAnchoring quantification to your control framework
Quantification sits on top of your control framework — it does not replace it. The simplest mapping that holds up under audit:
- Essential Eight — each mitigation strategy reduces either loss event frequency (e.g. application control, patching) or loss magnitude (e.g. backups, restrict admin).
- ISO 27001 Annex A — controls cluster against the same two levers; map by control family.
- APRA CPS 234 — information security capability requirements drive frequency reduction; testing and incident management drive magnitude reduction.
- SOCI CIRMP — your CIRMP risk register becomes the input list; quantification becomes the residual-risk view your board approves.
What goes on the slide
The board does not need the model. They need a single page:
- Top five risks with current and target ALE ranges (e.g. "AUD 3.2M–11.8M current, AUD 1.4M–5.9M with proposed investment").
- The dominant loss driver for each risk (regulatory, business interruption, response cost, reputation).
- The control investments under consideration and their cost.
- The single decision being asked of the board.
FAQ
What is cyber risk quantification?
Cyber risk quantification (CRQ) expresses risk in financial terms — typically annualised loss expectancy in a dollar range with a confidence interval — rather than as a red/amber/green heat map. The most widely adopted method internationally is FAIR (Factor Analysis of Information Risk), which decomposes risk into loss event frequency and loss magnitude.
Why are Australian boards demanding it?
APRA CPS 230 and CPS 234, SOCI Act board attestation, and the AICD director duties around cyber oversight have all raised the evidentiary bar. A heat map cannot answer "what would this control investment buy us in reduced annualised loss" — quantification can. Directors want the same currency they use for every other business risk.
Do we need a full FAIR program to start?
No. Most Australian organisations start with a top-10 risk register quantified at a defensible range using internal incident data, ASD/ACSC threat data, IBM Cost of a Data Breach Australian figures, and industry benchmarks. Precision improves with iteration; you do not need a six-month FAIR rollout to deliver the first board-grade view.
How does this connect to Essential Eight, ISO 27001 and APRA?
Quantification sits on top of your control framework, not instead of it. Each Essential Eight mitigation, ISO 27001 Annex A control or APRA CPS 234 obligation maps to a reduction in either loss frequency or loss magnitude. Quantification gives you the dollar value of that reduction so investment decisions become defensible.
What goes in a board-grade risk slide?
Top five risks expressed as annualised loss ranges with confidence intervals, the dominant loss driver for each (regulatory, business interruption, response cost, reputational), the control investments under consideration, and the residual range if those investments are funded. One slide, three minutes, decision-ready.