Quantifying CyberRisk: Solving the Riddle

Can companies accurately quantify cybersecurity risk? Traditional frequentist probability models break down in the face of adaptive human adversaries. This piece argues for a Bayesian approach — one that accounts for uncertainty, motivation, and threat adaptation.

Originally published on LevelBlue

In the late 1990s, the cybersecurity industry attempted to quantify a "Return on Security Investment" (ROSI), borrowing from the common business concept of ROI. The fundamental failing was mathematical: it is nearly impossible to quantify an event not occurring. If a company experiences zero security events in a year, was the $5 million security expenditure appropriate? The concept never worked because it was mathematically flawed.

Fast forward to today, and companies are once again fixated on quantifying cyber risk. The question remains: Can companies accurately quantify cybersecurity risks?

Key Definitions

Risk — An artificial construct expressed as R = f(P × I), where P is the probability of an adverse event and I is the impact, expressed in monetary terms.
Probability — The likelihood of something happening. Can be quantified (deterministic) or qualified (non-deterministic). Frequentist models quantify; Bayesian models qualify using updated beliefs.
Security — The implementation of controls commensurate with identified risks.

Where Traditional Models Fail

Consider a natural gas well with a valve that has a known mean failure rate of 1 in 2 million actuations. This is a deterministic model: given a large enough population, the failure rate is predictable. Controls can be engineered with confidence.

Now consider a security event at that same well — a disgruntled employee, a competitor, a nation-state actor. Security events do not occur by happenstance; they are actions taken by humans with motivation. And human behavior cannot be predicted with the same precision as valve failure rates.

This is Knightian uncertainty — a fundamental degree of ignorance and unpredictability where no quantifiable knowledge about event occurrence exists. Frequentist probability models, which assign objective probabilities based on repeated experiments under ideal conditions, cannot serve as predictive mechanisms under Knightian uncertainty.

The Human Element

The Department of Homeland Security's Security Lexicon defines Adaptive Threats as:

"...threats intentionally caused by humans...caused by people that can change their behavior or characteristics in reaction to prevention, protection, response, and recovery measures taken."

Even if a risk model accounts for current attacker behavior, it likely ignores:

Rationality — People act in their own interests, which change over time
Threat adaptation — As defenses improve, attackers adapt their tactics
Exogenous events — A movie studio that offends a world leader cannot have predicted a sophisticated nation-state attack as a result of that creative decision

The Bayesian Alternative

Where frequentist models fail, Bayesian probability offers a more appropriate framework. Rather than requiring a fixed historical dataset of identical events, Bayesian analysis:

Starts with a prior probability based on available knowledge
Updates that probability as new evidence is gathered
Accounts for uncertainty and changing conditions explicitly
Allows for subjective, informed judgments about likelihood

This approach acknowledges what frequentist models cannot: that cyber adversaries are adaptive, motivated humans operating in a world of incomplete information.

Conclusion

The riddle of quantifying cyber risk cannot be fully solved with traditional probability models. Any vendor claiming to give you a precise risk number is likely applying frequentist methods to an inherently non-deterministic problem. A Bayesian approach — one that embraces uncertainty, updates on new evidence, and accounts for human motivation and adaptation — is the more honest and ultimately more useful framework for enterprise cyber risk management.