Stop Showing Your Board Colours

Severity scores describe a finding without describing its business impact

Most security programmes still order their work by technical severity, and the weakness of that approach becomes clear as soon as two findings are placed side by side. A critical vulnerability on an isolated test box and a medium one on the payments platform are very different problems, yet a severity-sorted backlog ranks the test box first. Repeated across thousands of findings, the pattern produces a familiar outcome. Backlogs shrink while leadership still cannot say whether the company is any safer.

What the severity score lacks is business context. A useful assessment has to establish what the asset does for the business and what a loss would cost if an attacker reached it. Those two questions are where quantification begins.

A defensible estimate is a range with its assumptions shown

Cyber risk quantification (CRQ) answers those questions by expressing risk as a range of potential financial loss. The estimate rests on two inputs: how often a loss event is likely to happen, and how much it would cost when it does. Framed this way, cyber risk can sit next to the other exposures on the corporate risk register.

DataObserve S.A.F.E builds that estimate on open standards. FAIR defines risk as loss event frequency multiplied by loss magnitude, while MITRE ATT&CK grounds each scenario in real attacker techniques. The results map to NIST CSF, a framework most boards already recognise, so the analysis fits existing governance.

The output is presented as a range with a stated confidence level, which avoids the false precision of a single figure. Every estimate also shows the frequency and magnitude inputs behind it, so anyone in the room can examine those inputs and challenge them. When an input is missing, S.A.F.E widens the range to make the gap visible. A chief financial officer is far more likely to trust a number that openly admits what it does not know.

Quantified risk changes how budgets and limits are set

The most immediate effect of quantification is on budget discussions. A team asking for "more security" can model each option and compare the risk it removes with what it costs. An EDR rollout becomes a line item with a measurable effect on exposure. Proposals for network segmentation or better backups can be assessed on exactly the same basis.

Quantification also gives the board a way to govern cyber risk directly. A board can set a financial threshold for cyber risk and track exposure against it, in the same way it already treats credit or market risk. That turns a general concern into a governed limit with a clear owner. Insurance decisions become easier as well, because cover and limits can be weighed against exposure figures and the assumptions behind them.

Smaller organisations can begin with a handful of scenarios

CRQ is often treated as an exercise reserved for large enterprises, although it does not need to be one. Any organisation that prioritises security spend or reports risk to a board benefits from an estimate it can defend. A sensible starting point is a few critical scenarios, such as ransomware on the platform that earns the revenue, with the scope expanding from there. Confidence in the figures rises as better data arrives, so an early estimate with wide ranges is still a useful foundation for the work that follows.

A loss estimate matters when it changes what happens next

In S.A.F.E, quantification sits inside a wider operating loop in which teams assess exposure, translate it into business terms, act on it and report on the result. Exposures are ranked by reachability and threat activity and then weighed against potential loss, so severity alone never sets the order of work. Fixes move through named owners and approvals, and tickets sync both ways with ServiceNow and Jira.

A ticket closes only after the risk reduction has been verified. Each assessment and decision keeps its evidence attached, along with any exception, so the number on the board slide can be traced back to the work that changed it. Agents carry the heavy lifting of investigation and recommendation, while people approve fixes and exceptions and own every decision to accept risk. The audit trail records the contributions of both.

Money gives boards a unit they can make decisions with

Colour ratings made cyber risk easy to display, and that convenience has cost boards the ability to weigh it properly against everything else on the agenda. A financial range with visible assumptions gives directors something they can compare with other risks and govern over time. Over the next few years, the security teams that earn budget and trust are likely to be the ones that speak the board's own language, showing which work reduced the company's exposure and explaining what they would do next.