Risk Assessment, Analytics and Treatment

Introduction

Cybersecurity risk management converts uncertainty about digital threats into informed decisions. Organisations rarely have enough money, people, or time to eliminate every vulnerability. They must therefore determine which risks matter most, estimate their possible consequences, select proportionate treatments, and monitor whether those treatments remain effective.

Risk assessment is the analytical foundation of this process. It includes identifying assets, threats, vulnerabilities, existing controls, consequences, and likelihood. Risk treatment then determines whether a risk should be avoided, mitigated, transferred, or accepted. Governance ensures that decisions are authorised, documented, reviewable, and consistent with legal and organisational obligations.

This chapter presents qualitative, semi-quantitative, and quantitative approaches. It also explains threat modelling, scenario analysis, expected loss, cost-benefit analysis, treatment planning, and monitoring. The emphasis is practical: a cybersecurity professional should be able to produce a defensible risk assessment rather than merely assign a high, medium, or low label.

Learning objectives

By the end of this chapter, you should be able to:

• explain the relationship among assets, threats, vulnerabilities, controls, likelihood, impact, and risk;
• distinguish qualitative, semi-quantitative, and quantitative assessment methods;
• construct and interpret a likelihood–impact matrix;
• develop threat scenarios using structured threat modelling;
• calculate single-loss expectancy, annualised loss expectancy, and expected loss under stated assumptions;
• compare treatment options using cost-benefit reasoning;
• select avoidance, mitigation, transfer, or acceptance appropriately;
• design treatment plans with owners, measures, deadlines, and residual-risk thresholds; and
• monitor changing risk and report it through suitable governance channels.

1. Foundations of cybersecurity risk

1.1 Risk as uncertainty affecting objectives

Risk is commonly described as the effect of uncertainty on objectives. In cybersecurity, the objectives may include confidentiality, integrity, availability, safety, privacy, regulatory compliance, financial performance, and public trust. A risk exists when a threat can exploit a vulnerability and cause an undesirable consequence.

A useful conceptual chain is:

Asset → vulnerability → threat event → consequence → business impact

For example, a customer database is an asset. Excessive database privileges are a vulnerability. A compromised administrator account is a threat event. Unauthorised extraction of records is the consequence. Notification costs, legal exposure, customer loss, and regulatory sanctions are possible impacts.

Risk is not identical to a vulnerability. A vulnerability is a weakness; risk depends on the likelihood that the weakness will be exploited and the severity of the resulting consequences. Nor is risk identical to a threat. A threat is a potential cause of harm, whereas risk combines that possibility with organisational exposure.

1.2 Inherent, current, and residual risk

Inherent risk is the risk before considering controls. Current risk is the risk under existing controls. Residual risk is the risk remaining after a proposed or implemented treatment. These terms must be used consistently because a control may reduce likelihood, impact, or both.

For example, network segmentation may reduce the likelihood that a compromised workstation reaches a payment system. Backups may not reduce the likelihood of ransomware, but they can reduce the impact by enabling recovery. Insurance may not reduce the probability or technical consequences of an incident, but it can transfer part of the financial consequence.

A risk owner is the person accountable for deciding how a risk will be treated and whether residual risk is acceptable. A control owner is responsible for operating or implementing a particular control. These roles may be held by different people.

1.3 Risk appetite and tolerance

Risk appetite is the broad amount and type of risk an organisation is willing to pursue or retain. Risk tolerance is the acceptable variation around a specific objective or risk criterion. For instance, an organisation may have very low tolerance for unauthorised disclosure of health information but accept modest downtime for an internal information portal.

Risk criteria should be established before assessment where possible. Otherwise, assessors may unconsciously change the meaning of “high” to fit a preferred treatment. Criteria normally specify impact dimensions, likelihood scales, thresholds, escalation rules, and approval authorities.

2. The risk assessment process

A defensible assessment normally follows these stages:

1. Establish context: define scope, objectives, legal requirements, stakeholders, assumptions, and risk criteria.
2. Identify assets and processes: determine what supports important services and information flows.
3. Identify threats and vulnerabilities: consider malicious, accidental, technical, environmental, and third-party causes.
4. Identify existing controls: record preventive, detective, corrective, and recovery controls.
5. Construct scenarios: describe who or what could act, through which pathway, against what asset, and with what consequence.
6. Estimate likelihood and impact: apply qualitative, semi-quantitative, or quantitative methods.
7. Evaluate risk: compare results with appetite, tolerance, legal duties, and treatment criteria.
8. Treat and record: select an option, assign an owner, define milestones, and record residual risk.
9. Monitor and review: update assumptions when systems, threats, controls, or business conditions change.

Assessment should be iterative. A new cloud service, merger, major vulnerability, regulatory change, or security incident may invalidate an earlier assessment.

3. Qualitative assessment

Qualitative assessment uses descriptive categories such as rare, possible, and almost certain, or low, medium, high, and extreme. It is valuable when data are scarce, decisions must be made quickly, or consequences are difficult to express financially. Workshops, interviews, audit findings, incident records, and expert judgement are common evidence sources.

A simple matrix combines likelihood and impact. Suppose both are scored from 1 to 5. A basic score can be calculated as:

Here, R is the risk score, L is the ordinal likelihood score, and I is the ordinal impact score. The multiplication is a prioritisation convention, not a probability law. It is meaningful only when the organisation defines the scale, applies it consistently, and states how scores map to action.

An example classification is:

The boundaries above are illustrative, not universal. An organisation may classify a score of 12 differently because its appetite, regulatory obligations, or risk concentration differs.

Qualitative scales should be anchored. “Possible” might mean an event is expected once in three to ten years, while “almost certain” might mean it is expected annually or more frequently. The exact definitions should reflect the organisation’s context. Impact anchors should likewise describe financial, operational, legal, safety, privacy, and reputational consequences.

Strengths and limitations

Qualitative assessment is transparent and accessible to non-specialists. It supports early prioritisation and encourages discussion of consequences that cannot easily be monetised. However, two assessors may interpret the same category differently. Ordinal scores also do not necessarily have equal intervals: a likelihood score of 4 is not automatically twice the likelihood of a score of 2. Consequently, multiplying scores must not be presented as precise probability analysis.

4. Semi-quantitative assessment

Semi-quantitative assessment assigns numerical bands or weighted values without claiming that the numbers represent precise probabilities or monetary amounts. It provides more differentiation than simple labels while retaining expert judgement.

An organisation may score several impact dimensions, such as confidentiality, integrity, availability, privacy, and compliance. If weights are used, they should sum to 1. A weighted impact index can be represented as:

where i_j is the score for impact dimension j, w_j is its weight, and ∑w_j = 1. The scores must use a defined common scale, and the result is an index rather than a monetary loss. Weighting is appropriate only when the organisation has a defensible reason to give some consequences greater importance.

For example, suppose confidentiality, integrity, and availability receive weights of 0.4, 0.3, and 0.3, with scores of 5, 3, and 4 respectively:

If likelihood is scored as 4, the semi-quantitative priority index is 4 × 4.1 = 16.4. The organisation must define what 16.4 means and should avoid comparing it directly with a dollar estimate from another method.

Semi-quantitative methods are useful for ranking a portfolio, especially when a single risk has multiple impact dimensions. Their weakness is false precision. Decimal outputs can create an impression of measurement accuracy that the underlying judgements do not support.

5. Quantitative assessment and expected loss

Quantitative assessment uses numerical estimates such as event frequency, probability, loss magnitude, control cost, and investment return. It is most useful when reliable data exist and decisions involve substantial financial trade-offs. Quantitative results should include assumptions, ranges, uncertainty, and sensitivity analysis.

5.1 Single-loss expectancy

Single-loss expectancy (SLE) estimates the loss from one occurrence of a defined event. A common model is:

AV is the asset value in currency units, and EF is the exposure factor, expressed as a proportion from 0 to 1. The exposure factor represents the fraction of value lost in one event. The model assumes that the selected asset value and exposure factor are appropriate for the scenario and that losses are measured on a consistent basis.

If a service is valued at €800,000 and a severe outage is estimated to destroy 25% of the relevant value, then:

The result is not necessarily the organisation’s total financial loss. It may exclude recovery costs, legal costs, knock-on effects, and uncertainty unless those are included in the asset value or exposure factor.

5.2 Annualised loss expectancy

Annualised loss expectancy (ALE) estimates the expected loss per year under repeated-event assumptions:

ARO is the annual rate of occurrence, measured as expected events per year. If ARO = 0.4 and SLE = €200,000, then:

This is an expected value, not a forecast that exactly €80,000 will be lost each year. One year may contain no event; another may contain several. The estimate is most defensible when event frequency is stable enough for the planning period and the loss estimate is comparable across events.

A more general expected-loss model is:

where p_k is the probability of outcome k, l_k is its loss, and ∑p_k = 1. This model is useful when scenarios have several possible outcomes rather than one fixed loss.

5.3 Worked quantitative example

An online retailer estimates that a credential-compromise scenario has three annual outcomes:

The expected annual loss is:

The probabilities sum to 1.00, and each term has units of currency per year when the probabilities describe annual outcomes. The result should not be interpreted as certainty. It is a decision-support estimate.

5.4 Uncertainty and sensitivity

Risk estimates are uncertain because data may be incomplete, threats may change, and losses may be correlated. A professional report should state whether estimates are based on internal incidents, industry data, testing, expert elicitation, or assumptions. Ranges may be more honest than single values. Sensitivity analysis asks how the decision changes if a key variable changes.

For example, if the annual event rate could plausibly range from 0.1 to 0.5 and SLE is €200,000, ALE ranges from €20,000 to €100,000. This range may materially affect whether a control costing €70,000 per year is economically justified.

6. Threat modelling and scenario construction

Threat modelling provides a structured way to identify attack paths and control requirements. It should be applied to systems, applications, processes, data flows, and third-party connections—not only to individual vulnerabilities.

A practical scenario should identify:

• the asset or business service;
• the threat actor or accidental cause;
• the entry point and attack path;
• the vulnerability or enabling condition;
• the security property affected;
• the consequence and affected stakeholders;
• existing controls and their assumptions; and
• indicators that the event is developing or has occurred.

STRIDE is a commonly taught application threat-modelling mnemonic: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. It helps generate questions, but it does not itself calculate risk. Attack trees can represent how several conditions combine to achieve an attacker goal. A “credible worst case” should be distinguished from an implausible catastrophe; otherwise resources may be diverted toward dramatic but unlikely events.

A scenario statement should be specific. “The system may be hacked” is weak. “An external attacker uses password reuse against a supplier account, bypasses weak multi-factor authentication, accesses the order-management API, and modifies delivery addresses” is assessable because it identifies an actor, pathway, control weakness, and consequence.

7. Risk treatment decisions

The principal treatment options are avoidance, mitigation, transfer, and acceptance.

Treatment selection should consider legal and regulatory duties. An organisation may not be permitted to accept a risk involving mandatory safeguards, unsafe processing, or unlawful disclosure. Insurance does not excuse weak security, and outsourcing does not remove the data controller’s or service owner’s accountability.

7.1 Cost-benefit analysis

A simple economic comparison uses the reduction in expected annual loss. If a control reduces expected annual loss from E[L_before] to E[L_after], the annual risk reduction is:

If annual control cost is C, a basic net benefit is:

For the retailer example, suppose phishing-resistant MFA costs €18,000 annually and reduces expected annual loss from €30,000 to €8,000. The estimated benefit is €22,000 and the net benefit is €4,000 per year. This supports adoption financially, although non-financial benefits—such as compliance, customer confidence, and reduced operational disruption—should also be considered.

When comparing multi-year investments, discounting may be appropriate. The net present value is:

Here, C₀ is the initial cost, B_t and C_t are benefits and operating costs in year t, and r is the discount rate per year. The calculation assumes that cash flows, timing, and discount-rate conventions are defined consistently. Cybersecurity benefits are often difficult to value, so NPV should support—not replace—risk, legal, ethical, and resilience judgement.

8. Treatment plans and residual risk

A treatment plan turns a decision into accountable action. It should contain:

Controls should be expressed as outcomes where possible. “Improve security” is not measurable. “Enable phishing-resistant MFA for all privileged and remote-access accounts by 30 June; achieve 98% enrolment; test recovery procedures quarterly” is measurable.

Residual risk should be reassessed after implementation. A control may be deployed but poorly configured, bypassed, unavailable during an incident, or dependent on an unassessed supplier. Risk acceptance should name the accepter, expiry or review date, assumptions, and triggers for reconsideration.

9. Monitoring, metrics, and governance

Risk monitoring asks whether the risk environment and control performance remain within approved boundaries. Useful indicators include privileged-account MFA coverage, critical-patch age, backup restoration success, phishing-reporting rate, mean time to detect, mean time to contain, unresolved high-risk findings, supplier assessment status, and exceptions past their expiry date.

A metric must have a defined numerator, denominator, population, period, data source, owner, and target. For example, “critical patches overdue” is more useful when defined as the number of internet-facing critical assets exceeding the patch service-level agreement at the reporting date. Metrics should not reward concealment or superficial compliance. A falling incident count may indicate improvement—or reduced detection and reporting.

Key risk indicators describe exposure or emerging conditions; key performance indicators describe control activity or achievement. A governance report should show trends, tolerance breaches, major assumptions, treatment status, accepted exceptions, and decisions required from management.

Monitoring should operate at several levels. Operational teams inspect controls and alerts. Risk and compliance functions challenge methods and consolidate exposure. Senior management allocates resources and accepts or escalates risk. The board or governing body oversees whether cyber risk is aligned with organisational objectives and legal responsibilities.

10. Illustrative case: Northbridge Community Hospital

Background

Northbridge Community Hospital, a fictional illustrative case, uses a cloud-based electronic health-record system connected to diagnostic devices, a billing provider, and a remote-support vendor. Patient safety and continuity of care are critical. The hospital has limited security staff and must comply with privacy and health-record obligations.

Problem

An assessment identified that the remote-support vendor used shared administrator credentials for several systems. Vendor access was logged inconsistently, and some clinical devices could communicate broadly across the network. A ransomware attack could interrupt clinical operations and expose patient information.

Analysis

The team developed a scenario: an attacker obtains a vendor credential through phishing, enters the remote-support channel, moves from an administration workstation to a clinical server, encrypts records, and copies sensitive data. Existing controls included endpoint protection, daily backups, and annual vendor reviews. Weaknesses included shared credentials, insufficient segmentation, and untested restoration of several clinical applications.

The qualitative assessment rated likelihood as 4 out of 5 and impact as 5 out of 5, producing a score of 20 and an extreme classification under the hospital’s matrix. The score did not prove a 20-fold risk; it triggered urgent governance attention.

For a financial perspective, the hospital estimated a major event loss of €600,000 and an annual rate of occurrence of 0.15, giving:

Because a major event could have several outcomes and patient-safety consequences, the hospital did not rely on ALE alone.

Approach and solution

The hospital selected mitigation rather than avoidance because remote support was operationally necessary. It required named vendor accounts, phishing-resistant MFA, just-in-time privileged access, session recording, and access expiry. Network segmentation restricted communication between administrative and clinical zones. Immutable backups were introduced, and restoration tests were scheduled each quarter. The contract was amended to require notification, cooperation, audit evidence, and minimum security controls. Cyber insurance was reviewed as a supplementary transfer mechanism, not as a replacement for controls.

The risk owner was the chief operating officer, while the information-security manager owned the treatment programme. Measures included 100% named-account coverage, 100% MFA coverage for privileged remote access, quarterly restoration tests with documented recovery times, and no unapproved vendor sessions.

Outcome

After implementation, the assessed likelihood fell from 4 to 2 and impact from 5 to 4 because segmentation and tested recovery reduced the plausible consequences. The residual score was 8, classified as moderate. The hospital accepted this residual risk for six months, subject to monthly monitoring and a formal review after the next major system upgrade.

Learning points

The case demonstrates that risk treatment is a portfolio of technical, contractual, operational, and governance measures. It also illustrates that risk reduction should be evidenced through control performance and testing, not assumed merely because a policy or tool exists. Patient safety and privacy obligations require broader judgement than financial calculations alone can provide.

11. Ethical, legal, and professional considerations

Risk analysis can affect individuals whose data, safety, employment, or access to services is involved. Assessors should avoid treating privacy as merely a financial asset. Data minimisation, purpose limitation, access accountability, and proportionality may be legal requirements as well as ethical principles.

Risk ratings should not be manipulated to avoid escalation. Suppressing uncertainty, understating impact, or excluding inconvenient scenarios undermines informed governance. Automated scoring and AI-assisted analysis can accelerate evidence review, but they may reproduce biased historical data, miss novel attack paths, expose confidential information, or generate unsupported confidence. Human review, traceable sources, access controls, validation, and documented limitations are essential.

Organisations should also consider concentration risk. A common cloud provider, identity platform, or software dependency may create correlated failures across many services. A series of individually moderate risks may therefore produce a severe systemic exposure. Third-party risk assessments should examine actual service dependencies, subcontractors, incident duties, recovery capabilities, data location, and exit arrangements.

12. Best-practice principles

Effective assessment and treatment commonly follow these principles:

1. Define scope, assumptions, criteria, and decision authority before scoring.
2. Use scenarios that connect threats to business consequences.
3. Match the method to the decision: qualitative for rapid prioritisation, semi-quantitative for structured ranking, and quantitative when evidence supports financial estimation.
4. Never present ordinal scores as precise probabilities.
5. Record uncertainty, data sources, and sensitivity to assumptions.
6. Consider legal, safety, privacy, resilience, and ethical effects alongside monetary loss.
7. Treat suppliers, cloud services, identity systems, and shared dependencies as part of the attack surface.
8. Assign accountable owners and measurable deadlines.
9. Verify control effectiveness through testing, observation, and incident evidence.
10. Review residual risk when systems, threats, regulations, business processes, or assumptions change.

Chapter Summary

Risk assessment provides a structured basis for cybersecurity decisions. It links assets, vulnerabilities, threats, consequences, controls, likelihood, and impact. Qualitative methods use defined categories and matrices; semi-quantitative methods provide weighted or ranked indices; quantitative methods estimate probabilities, losses, and expected values. Ordinal matrix scores are useful for prioritisation but should not be confused with precise probability calculations.

Threat modelling improves assessment by constructing credible attack or failure scenarios. Expected-loss methods, including SLE = AV × EF, ALE = SLE × ARO, and E[L] = ∑(p_k × l_k), support economic reasoning when assumptions and units are explicit. Cost-benefit analysis compares risk reduction with implementation and operating costs but cannot replace legal, ethical, safety, or governance judgement.

Treatment choices are avoidance, mitigation, transfer, and acceptance. A treatment plan requires an owner, resources, milestones, success measures, residual-risk assessment, and approval. Continuous monitoring uses indicators, testing, trend analysis, and escalation to ensure that treatment remains effective as technology, threats, regulations, and business conditions change.

Key Terms

Risk: The effect of uncertainty on objectives.

Asset: Information, technology, service, person, or capability that has value to an organisation.

Threat: A potential cause of an unwanted incident.

Vulnerability: A weakness that may be exploited or triggered.

Threat scenario: A structured description of a possible threat event, pathway, and consequence.

Inherent risk: Risk before considering controls.

Residual risk: Risk remaining after treatment or controls.

Risk owner: Person accountable for deciding how a risk is managed.

Control owner: Person responsible for implementing or operating a control.

Risk appetite: The broad amount and type of risk an organisation is willing to retain or pursue.

Risk tolerance: Acceptable variation around a defined objective or risk criterion.

Qualitative assessment: Assessment using descriptive categories and expert judgement.

Semi-quantitative assessment: Assessment using numerical bands or indices without claiming precise measurement.

Quantitative assessment: Assessment using numerical probabilities, frequencies, losses, or monetary values.

Single-loss expectancy: Estimated loss from one defined occurrence, commonly SLE = AV × EF.

Annualised loss expectancy: Expected annual loss, commonly ALE = SLE × ARO.

Risk treatment: Action taken to modify risk.

Risk acceptance: A documented decision to retain risk within approved criteria.

Key risk indicator: A measure of exposure or changing risk conditions.

Residual-risk threshold: The maximum remaining exposure accepted under defined authority.

Review Questions

Short Answer Questions

1. Distinguish a vulnerability from a cybersecurity risk.
2. What is the difference between inherent risk and residual risk?
3. Why should ordinal matrix scores not be interpreted as precise probabilities?
4. Define single-loss expectancy and identify its two variables.
5. Name the four principal risk treatment options.

Long Answer Questions

1. Explain the stages of a complete cybersecurity risk assessment and show how governance supports each stage.
2. Compare qualitative, semi-quantitative, and quantitative assessment methods, including their strengths and limitations.
3. Explain how threat modelling improves the quality of risk scenarios and treatment decisions.
4. Discuss how legal, privacy, safety, and ethical considerations influence risk acceptance and transfer.
5. Describe the contents of an effective risk treatment plan and explain why monitoring must continue after implementation.

Analytical / Application Questions

1. A service has an asset value of €500,000, an exposure factor of 0.30, and an annual rate of occurrence of 0.20. Calculate SLE and ALE, state the units, and explain one limitation of the estimate.
2. An organisation’s expected annual loss is €75,000 before a control and €25,000 after it. The control costs €35,000 per year. Calculate the annual risk reduction and simple net benefit, then identify one non-financial factor that could affect the decision.
3. A supplier uses shared privileged accounts to support a critical hospital system. Construct a threat scenario, identify at least three treatments, and propose two measurable monitoring indicators.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes residual risk from inherent risk?

A. Residual risk exists before any controls are considered

B. Residual risk is the risk remaining after controls or treatment

C. Residual risk is always transferred to an insurer

D. Residual risk is the same as a vulnerability

Correct Answer: B. Residual risk is the risk remaining after controls or treatment

Question 2

A risk has a likelihood score of 4 and an impact score of 5. Using R = L × I, what is the risk score?

A. 9

B. 16

C. 20

D. 25

Correct Answer: C. 20

Question 3

Which statement about multiplying ordinal likelihood and impact scores is correct?

A. It always produces a precise probability of loss

B. It is a prioritisation convention whose meaning depends on defined scales

C. It is valid only when all risks have equal financial value

D. It eliminates the need for expert judgement

Correct Answer: B. It is a prioritisation convention whose meaning depends on defined scales

Question 4

An asset is valued at €200,000 and its exposure factor is 0.25. What is the single-loss expectancy?

A. €50,000

B. €80,000

C. €200,025

D. €800,000

Correct Answer: A. €50,000

Question 5

If SLE is €50,000 and the annual rate of occurrence is 0.2, what is the ALE?

A. €2,500 per year

B. €10,000 per year

C. €50,000 per year

D. €250,000 per year

Correct Answer: B. €10,000 per year

Question 6

Which treatment changes the design or stops an activity so that the original risk no longer occurs in that form?

A. Acceptance

B. Transfer

C. Mitigation

D. Avoidance

Correct Answer: D. Avoidance

Question 7

Which item is most important for making a risk treatment plan accountable?

A. A general statement that security should improve

B. An owner, deadline, measurable outcome, and residual-risk decision

C. A list of threats without assigned actions

D. A risk score with no supporting assumptions

Correct Answer: B. An owner, deadline, measurable outcome, and residual-risk decision

Question 8

A control reduces expected annual loss from €40,000 to €15,000 and costs €18,000 per year. What is the simple annual net benefit?

A. €7,000

B. €18,000

C. €25,000

D. €43,000

Correct Answer: A. €7,000

Question 9

Which statement about cyber insurance is most accurate?

A. It removes the organisation’s legal accountability

B. It always reduces the probability of an attack

C. It may transfer some financial consequences but does not replace security controls

D. It guarantees recovery from every incident

Correct Answer: C. It may transfer some financial consequences but does not replace security controls

Question 10

Which is a key risk indicator rather than merely a control activity measure?

A. Number of security staff attending training

B. Number of policy documents published

C. Number of critical internet-facing assets overdue for patching

D. Number of meetings held by the risk committee

Correct Answer: C. Number of critical internet-facing assets overdue for patching