Quantifying cyber risk for the board

A board decides with numbers. Revenue, multiples, leverage, expected returns: everything is expressed in a common language. Cyber risk, too often, arrives at that table in a different one — a list of technical findings, a score from a tool, a colour scale. It does not fold into the decision because it does not talk about money.

Quantifying cyber risk means translating it into terms a board can compare with any other risk in the deal: an economic exposure, with an order of magnitude and a stated degree of uncertainty. You don’t need accounting precision. You need a defensible number and honesty about how uncertain it is.

Likelihood times impact, without false precision

At the base of every quantification is the same idea: risk is the combination of how likely a scenario is to happen and how much it would cost if it did. A rare but devastating scenario and a frequent but modest one can be worth the same, and they should be treated differently.

The value is not in the model but in the explicit reasoning. Defining a few plausible scenarios — ransomware that halts production, a breach of regulated data, the compromise of a critical supplier — and estimating likelihood and impact for each forces the assumptions into the open. Explicit assumptions can be debated and corrected; an opaque score cannot.

Exposure that moves price versus noise

The most useful distinction you can offer a board is between material risks and noise. A diligence always produces dozens of findings. Most are ordinary hygiene: they are resolved by normal post-close work and do not deserve the decision-maker’s attention.

A few findings, instead, move price: a structural remediation in the order of millions, a concrete legal liability tied to a prior incident, a critical dependency with no alternative. The job of whoever reports is to separate the two groups clearly, so the board spends attention where it counts and does not drown in an undifferentiated list.

Building a defensible range

A single number gives false confidence. It is more honest and more useful to present a range — a prudent scenario, a central one, an adverse one — with the assumptions that generate it. A range communicates both the estimate and its uncertainty, and it is harder to contest precisely because it does not pretend to a precision it lacks.

The range’s credibility depends on traceability. Every figure should trace back to a finding, an assumption or a reference data point. When a board member asks «where does this number come from», an answer that holds must exist.

It is also useful to separate one-off exposure from recurring exposure: the cost of remediating a structural gap is paid once, while the expected loss from a risk scenario recurs every year until the control changes. A board reasons differently about the two kinds of number, and it is better not to blur them into a single figure.

Speaking the board’s language

How you present matters as much as the content. A board has little time and many risks to compare. The useful version is short: what the material exposure is in economic terms, how it sits against the deal value, what would change the conclusion, and which actions would reduce it.

Cyber risk becomes a line item beside the others — not a technical appendix no one reads, but a factor the board can weigh, price or mitigate as it would any other exposure.

What to avoid

Two recurring mistakes weaken a quantification. The first is false precision: presenting figures to many decimal places built on fragile assumptions invites debate about the decimal instead of the substance. The second is alarmism: inflating the exposure to attract attention erodes credibility at the first check, and with it the weight of everything you say.

The right posture is restraint: prudent numbers, explicit assumptions, stated uncertainty. A board trusts whoever shows their reasoning, not whoever promises certainties the subject does not allow.

The takeaway

Cyber risk matters to an investment decision only if it is expressed in the language of the decision. Reason in likelihood and impact, separate material exposure from noise, present a traceable range instead of a falsely precise number, and avoid both false precision and alarmism. That is how cyber risk stops being an appendix and becomes part of the price.