Estimate annual cyber loss after zero trust safeguards by combining asset exposure, event probability, impact severity, and expected control effectiveness. The results separate inherent expected loss, residual expected loss, and loss avoided for budget and risk-treatment discussions.
The main result is the probability-weighted annual financial loss remaining after the modeled controls.
This model supports comparison and budgeting; it does not predict the amount of any individual incident.
With $8M exposed value, 12% event probability, 35% severity, and 60% effectiveness: inherent expected loss is $336,000 and residual expected loss is $134,400.
Use the financial exposure relevant to the scenario, such as replacement cost, revenue at risk, or a defensible combined impact estimate.
It represents the annual probability of the defined event affecting the modeled asset exposure as a whole.
No. It represents combined effectiveness of identity, device, network, workload, and operational controls in the modeled environment.
No. Expected loss is probability-weighted; conduct a separate severe-event scenario for worst-case planning.
It lets the model represent the portion of exposed value lost when the event occurs rather than assuming total loss.
| Variable | Meaning | Unit |
|---|---|---|
| Asset value | Financial exposure in scope | USD |
| Probability | Annual chance of the defined event | % |
| Impact severity | Share of exposed value lost if it occurs | % |
| Effectiveness | Expected loss reduction from controls | % |