Unlike any other industry report we're able to dial-down into business-level risk. We can do that because we've quantified the industry level risk and established baselines for each subindustry. That means we understand how effective controls actually are for blocking attacks. What we're seeing is that across all industries varying controls are less effective than initially thought, in part that's because organizations aren't consistent in their application, or because attackers are getting around them. What's important is that we're able to measure these differences leading to deeper insight at the business level.

First we move from the industry to subindustry risk by narrowing our focus. The subindustry level risk tells us what the environment is like, and based on activity from the last 90 days we're able to establish a likelihood of near future attacks. To get from the probability of an attack in the subindustry to the probability of an attack for your business requires a little bit of math, and a way to more fairly reflect the unique differences between individual businesses in any subsector. We use what is known as conditional probability to calculate the risk at the business level based both on what we know about the environment and the unique characteristics of the business.

There are Three main characteristics that drive which businesses are more likely to be targeted and how they will fare under attack. Using these three characteristics we've developed a set of business profiles that reflect every combination. That means you can pick the exact profile that reflects your organization. Each profile's risk estimate of impact has also already been adjusted to reflect how much it varies from the subindustry baseline.

In-depth risk analysis quantified for the top attack scenarios - that doesn't cost an arm or a leg (just the cost of a daily cup of coffee). Now that's what we call a game changer.