Estimate annual identity and access management risk before and after existing controls. Combine the number of exposed identities, annual compromise probability, average loss per compromised identity, and control effectiveness to quantify residual exposure, avoided exposure, and concentration per identity.
Residual exposure is the modeled annual loss that remains after the stated IAM controls. Compare it with control spending and risk tolerance.
This is a planning estimate. A single incident may affect multiple identities, so adjust the average loss input to reflect your incident model.
With 5,000 identities, a 4% probability, $25,000 loss, and 65% effectiveness: inherent exposure is $5,000,000 and residual exposure is $1,750,000.
Yes, when they can access valuable systems or data. Model them separately if their probability or impact differs materially.
It is entered per identity for one year and is multiplied by the number of exposed identities.
The calculator allows it for scenario testing, but real controls rarely eliminate every identity-related loss pathway.
No. It is an annual expected-loss estimate, not a worst-case or maximum-loss figure.
Use a separate scenario with their smaller count and higher average loss if privileged-account impact differs from ordinary accounts.
| Variable | Meaning | Unit |
|---|---|---|
| Identities | Accounts or people included in the model | count |
| Probability | Annual compromise chance per identity | % |
| Loss | Average financial impact per compromise | USD |
| Effectiveness | Share of modeled loss prevented | % |