Quantify inherent and residual cyber risk exposure for a zero trust program using asset value, annual event likelihood, financial impact, and separate identity, device, and segmentation control effectiveness. Combined effectiveness is calculated multiplicatively to avoid simply adding percentages.
Residual exposure accounts for overlapping control layers without assuming that their effectiveness percentages can be added directly.
The control layers may not be independent in practice. Use scenario ranges when dependencies are uncertain.
With $10M value, 15% likelihood, 40% impact, and effectiveness of 45%, 35%, and 30%, combined effectiveness is 74.975% and residual exposure is $150,150.
Multiplication models the remaining risk after each layer and prevents combined effectiveness from exceeding 100 percent.
Yes. Enter zero so it contributes no modeled risk reduction.
Only approximately. If they strongly depend on one another, use conservative effectiveness inputs or scenario ranges.
It is an expected exposure under the defined likelihood and impact assumptions; terminology may differ across risk frameworks.
Lower the impact percentage or attribute a defensible effectiveness value to segmentation, but do not count the same benefit twice.
| Variable | Meaning | Unit |
|---|---|---|
| Asset value | Financial exposure in scope | USD |
| Likelihood | Annual probability of the defined event | % |
| Impact | Share of exposed value lost if it occurs | % |
| Control effectiveness | Independent reduction attributed to each layer | % |