Decrypting Cyber Risk Quantification

Executive teams are faced with a challenging combination of an increasingly complex threat landscape and a rapidly growing attack surface. Together, these two factors are putting the modern enterprise at greater risk of exposure and potential breach.

For security leaders, understanding the unique risk profile of the organization is not only a critical first step, but a required, continuous process to protect the enterprise against malicious adversarial threats — whether it comes in the form of a simple phishing email, or a coordinated multi-step ransomware attack.

To understand this unique risk profile, organizations can leverage continuous or point-in-time risk assessments. Rating and benchmarking cyber risk offer many benefits and actionable insights to the security team by quantifying and weighing the likelihood of a threat actor gaining access to the corporate environment and the potential impact of this event. Cyber risk ratings can be displayed as a numerical or alphabetical integer and provide a mechanism to track and communicate security efficiency and progress over time.

Security leaders can leverage cyber risk quantification to prioritize cyber risks, align cyber risks with other risk practices, and elevate and communicate cybersecurity effectiveness outside of the security organization. According to Gartner, three out of the top 5 cyber risk quantification use cases target communication of risk exposure to different stakeholders including communication to risk owners, C-level executives, and to the board.

The evolution of cyber risk quantification: how we got here

Historically, due to cost, complexity, and limited readily available data, risk scoring had been deployed through point-in-time assessments and relied on less sophisticated insights like password complexity or data encryption usage.

As evaluation methods, regulations, and frameworks evolved (i.e., NIST Cybersecurity Framework) technology solutions have improved in accuracy by extending the number of security vectors and data inputs in an evaluation and delivering assessments on a continuous and on-demand basis.

However, with this growth came a new era of proprietary formulas unique to individual vendors. While technological innovation has been significant, end users have been challenged with black box products and limited insight into the mathematical formula and weighted factors used to develop risk scores for individual cyber assets and for the broader enterprise.

This has made it harder for security analysts and practitioners to know which levers to pull to improve their security posture and implement ongoing risk-informed decisions — and the black box approach has also spurred skepticism and doubt about the trustworthiness ad intention of a score.

Criteria for an accurate and trustworthy risk score

To maximize the value of cyber risk scoring, we should take six key factors into consideration:

• The number and quality of data sources
• Methodology availability and transparency
• Customizability
• Assessment frequency
• Benchmarking
• Actionable remediation insights.

Risk evaluation and quantification cannot be effective in silos. Cyber risk assessments sharpen when security organizations can connect more data sources from across the enterprise.

Ingesting and normalizing data from different cyber asset types including endpoint, server, workload, email, network, and identity in addition to cloud services, identity and access management, vulnerability management, threat intelligence feeds, and external attack surface discovery tools paint a more accurate picture of an organization’s overall risk.

Risk scoring should deliver actionable insights. Trustworthy risk scores will provide a transparent explanation of the methodology and formula used to develop the score. This disclosure can build confidence in the approach, but more importantly, it provides the ability to know which levers to pull to improve security posture, customize risk thresholds, and initiate remediation actions on high-risk assets.

Implementing risk scoring to develop well-informed security strategies

Correlating data from modern security tools like attack surface management, vulnerability management, and extended detection and response (XDR) can provide security teams with a comprehensive understanding of the attack intensity or pressure on their organization, where digital assets are vulnerable or left exposed, and where security configurations (i.e., endpoint protection coverage, or enabled behavior monitoring) can be improved to ensure the enterprise is well prepared and protected.

Real-time, contextualized risk data improves situational awareness and the ability to prioritize risk remediation actions on critical assets.

Building risk-informed security strategies extends benefits beyond the security team. For example, with risk data and remediation history readily available, cyber insurers can adjust premiums based on the likelihood and potential cost of an attack or incident. Risk assessments put organizations in the driver’s seat when it comes to controlling risk, which in turn can earn them more affordable premiums associated with lower levels of risk.

Quantifying and benchmarking contextualizes cyber risk and makes security more relatable outside of the immediate security organization. Gartner identified increased credibility, aligned cyber risk with enterprise risk, and understood cyber insurance needs as awareness-based results security leaders can achieve using cyber risk quantification methodologies. Security leaders can also leverage cyber risk quantification to achieve action-based results, including cost savings, improved security project prioritization, and added value to strategic decision-making.

How to communicate risk and build trust within your organization

As the role of the cybersecurity leader continues to evolve, building trust with both internal and external stakeholders is paramount. Leveraging human readable reporting and data visualizations helps connect security outcomes and risk management strategies with business objectives.

Maintaining a regular cadence of open and transparent communication with executives and the board better positions the security function as an enabler and strategic advisor.

Beyond the board, engaging with and educating business units internally builds a culture of security awareness, and lowers risk over time.

Innovation in cyber risk scoring: what’s next?

The future of cyber risk quantification looks promising. As security and executive teams alike benefit from the insights risk scoring provides, we can expect to see more demand, investment, and innovation in this space.

• Correlation improvements: Stronger insights through correlation and contextualization of data inputs including identity.
• More flexibility: Ability to customize risk thresholds and tolerance unique to the organization and accommodate existing security investments by integrating more third-party technologies to automatically inform changes in risk.
• Layering threat intelligence: Increased usage of threat intelligence feeds to bolster attack intensity telemetry and inform risk scoring models with the latest information on existing or emerging attack groups.
• Artificial intelligence and machine learning: Predictive and continuously updated modeling to identify patterns and better anticipate risks
• Compliance and regulation: With increased transparency around risk scoring formulas, regulators may begin to require continuous risk assessment and risk insight availability for organizations within specific industries to stay compliant.

To learn how Trend Micro Vision One™ calculates cyber risk, read our report: More than a number, your risk score explained.