Most quantitative risk models—whether VaR, actuarial, or FAIR—derive probability from historical frequency or distributions, whereas the Cyber Risk Forecast derives probability from changing conditions, allowing risk to be quantified even when historical data is incomplete or nonexistent.

At a technical level, this is achieved using Bayesian conditional probability, which enables probability to be assigned based on the presence, combination, and interaction of conditions that drive outcomes.

This same mathematical framework is used in domains where outcomes must be determined from interacting conditions —such as weather modeling and medical diagnostics, where the likelihood of an outcome is calculated from the structure and combination of contributing factors.

In these domains, models are designed to measure how changes in specific conditions—such as shifts in atmospheric pressure or the weakening of an immune response—directly alter the probability of the outcome. The model calculates how the presence, absence, or degradation of individual factors changes the likelihood within the system.

Applied to cyber risk, controls are represented in the same way. Control effectiveness is measured in terms of how their strength or degradation changes the probability of attack success under the conditions attackers are exploiting.

By deriving probability from conditions and contributing factors, the Cyber Risk Forecast can identify what is becoming likely next and identifying emerging risks.

Our approach enables a level of analysis that traditional models simply cannot achieve: It quantifies not just whether controls exist, but how much they reduce risk under the exact conditions attackers are exploiting.

This is what makes the unknown measurable—and the forecast actionable.

Every organization already has critical pieces of the puzzle.

Internal security teams and audits provide a deep understanding of systems, controls, and existing vulnerabilities. External intelligence and news reveal how attackers are operating and where their focus is shifting.

But these inputs rarely align in a way that answers a single, essential question:

What is most likely to impact our business next—and what will it cost us?

The forecast connects these inputs through structured risk profiles.

Each profile reflects the core drivers of cyber risk at the business level—data value, control maturity, and ecosystem exposure. Real-world attack activity is then mapped to those profiles to determine how threat behavior translates into probable attack paths, financial outcomes, and control dependencies.

The result is a clear, forward-looking view of risk that can be directly applied to your organization.

A cyber risk forecast provides clarity where most programs rely on assumptions.

Forecasts identify the attack scenarios most likely to emerge in the near term, quantify their potential financial impact, and highlight where control effectiveness materially changes the outcome.