The portfolio view
5 companies · $18.1M diversified fund P95The $26.2M net additive ceiling stays beside the diversified primary, with Apex Retail Group and the two companies needing attention visible. Illustrative values, not audited financials.
Real Valty Loss Exposure capture showing a modeled portfolio loss range, the current top capital decision, and the four-stage quantify, fund, authorize, and prove loop. Illustrative product data only, not customer data or a customer outcome.
Portfolio cyber risk in dollars. Human-governed AI.
Know which portfolio company carries the greatest financial cyber exposure. And what to fund first.
See portfolio cyber risk in dollars, then fund what changes it most. Keep AI decisions human-approved.
Valty quantifies portfolio cyber risk in dollars, ranks what to fund next, and verifies the result. In design-partner scope, AI governance keeps evidence and human approval attached.
Inspect assumptions and source evidence. Inspect the sample Proof Pack
Portfolio
See the fund in one risk currency. Then choose the next board move.
Compare companies on the same dollar basis, inspect whether the evidence earns trust, and keep contract exposure, cyber loss, and remediation impact separate until the evidence supports the decision.
The evidence state
349 of 425 controls assessed · 25 financial inputsSource, evidence confidence, coverage, data health, and model validation remain beside the values so a reviewer can see what earns trust.
The revenue basis
$43.4M contract revenue at risk (status quo)This revenue-basis measure, the $31.9M contract-linked gross P95 subtotal, $18.1M diversified fund P95, and $26.2M net additive ceiling stay separate. The evidence trail supports the next board action without adding unlike measures together.
Portfolio$18.1M diversified fund P95. The $26.2M ceiling is a sum of 5 company P95s, not a fund percentile.
- Source
- Modeled sensitivity
- Control coverage
- 349 / 425
- Financial inputs
- 25
PRIMARY
Diversified fund P955 illustrative companies
$18.1MCEILING
Net additive ceilingSum of 5 company P95s, not a fund percentile
$26.2MDRIVER
Top modeled-loss driverApex Retail Group
$10.4MCONTRACT
Contract revenue at risk (status quo)Revenue basis; separate from modeled cyber loss
$43.4MLINKED
Contract-linked gross P95 subtotalGross-scenario P95 sum for assessed contract-linked companies; not a fund percentile
$31.9MReadable summary of the current fund capture. The $18.1M diversified primary and $26.2M net additive ceiling use the same 5 company marginals. The $43.4M contract revenue at risk (status quo) is a revenue-basis measure; the $31.9M contract-linked gross-scenario P95 subtotal is modeled cyber loss. They remain separate and are not added together. Illustrative decision support, not a customer outcome.
Inspect the assumptions
Open the worked example before you apply.
Portfolio ranked the funding order. This step is different: inspect the assumptions, evidence lineage, confidence range, and blocked claims behind that decision — ungated and labeled illustrative, with the methods note attached.
Assumptions
Every modeled figure lists the inputs and defaults it depends on — inspect before you fund.
Evidence
Lineage and freshness sit next to the claim so stale or missing proof cannot hide.
Confidence
P10–P90 ranges replace false precision; blocked claims stay blocked until evidence lands.
Limits
Illustrative demo data is labeled as such — not a customer portfolio or customer outcome.
See the worked example
Ungated · methods note attached.
EBITDA Bridge
Watch cyber risk show up in the operating number.
See how modeled cyber exposure adjusts reported EBITDA. This historical illustrative $400M revenue manufacturer shows a $4–7M bridge (base case $5.4M) from reported to adjusted EBITDA using a 10,000-run FAIR model; the current app runs 50,000 trials. Sensitivity, not a valuation opinion.
Starting
$42.0M
Reported EBITDA
01Ransomware exposure−$1.8M
02Data breach liability−$2.1M
03Compliance penalties−$0.9M
04Business interruption−$1.4M
05Insurance recovery+$0.8M
Adjusted
$36.6M
After cyber risk · $35–38M range
The board asks for risk in dollars. Heatmaps cannot answer.
More data does not move an IC memo.
A dollar number does.
Your CISO has controls, alerts, and heatmaps. You still do not have a number you can put into an IC memo.
- Heatmaps
Cannot answer the IC funding question when the board asks for cyber risk in dollars.
Valty method - $4.7M
Average industry cost of a data breach (IBM). Most boards still cannot quantify their own exposure.
IBM 2024 - P10–P90
Every modeled figure ships as a range with method and source, not a single point the board cannot challenge.
Valty method
Independent research
The operating problem is already measured.
Independent research already measures cyber risk as deal and hold-period impact. Directors are asking management to report it in terms the business can act on.
Private equity transaction risk
“Cybersecurity has evolved into a material transaction risk, becoming a direct threat to deal flow and valuation in private equity.”
Kroll surveyed 325 private equity executives. Its February 2026 report found $2.1 million in average financial impact per incident and hold-period disruption at 80% of firms. It also describes the operating model more common at larger firms: formal portfolio mandates, standardized transaction diligence, dedicated cyber-risk leadership, and centralized platforms.
Dave Burg, Global Group Head of Cyber and Data Resilience at Kroll
Kroll · Cyber Risk at Scale · February 2026 (opens in a new tab)From diligence to action
“[Diligence observations] must get out of the reports and spreadsheets and onto the agenda.”
Benjamin Eason, Managing Director of Cyber at Apollo Global Management
as quoted by EY · March 2023 (opens in a new tab)Board reporting
57%
of private-company directors rated improving the quality of management’s cyber-risk reporting very or extremely important in the coming year.
NACD · Principle Five · April 2026 · private-company director sample n=85 (opens in a new tab)Independent industry sources, cited for context. No affiliation, endorsement, or customer relationship with any organization named above is implied. Valty's own method, range, and claim boundary sit with each modeled dollar on this page.
The PE decision loop
One operating layer from evidence to verified risk reduction.
Valty turns a portfolio cyber mandate into a repeatable decision record: standardized diligence, clear ownership, recurring evidence review, and a funding order the IC can challenge. It is decision support with human approval, not an autonomous verdict.
Quantify loss
Bring in findings, reachability evidence, cloud identity paths, and current public threat intelligence, then model cyber risk as a P10, base, and P90 loss-exposure range. Source, freshness, and missing context stay attached; AI governance records remain a separate, human-reviewed evidence path.
See the financial modelFund next
Rank actions by modeled loss reduced per dollar and show what fits inside the approved cap. Compound effects are included only when the recorded model and evidence support them.
See the funding orderAuthorize change
Valty can prepare bounded tickets or pull requests, while a designated human reviews the evidence and retains approval of production-impacting work.
See governed actionProve reduction
Closure requires returned evidence, not a closed ticket. Valty reruns the model, records the verified change, and packages the decision trail in a Proof Pack.
See the proof trailCurrent design-partner scope
- Reachability and cloud identity blast radius
- Threat signal to analyst-reviewed scenario draft
- Compound loss modeling with visible confidence ranges
Why Valty
What Valty adds to the stack you already own.
Valty does not ask you to replace these systems. It connects their evidence to a financial decision, an approved action, and proof of what changed.
Ratings and questionnaires
Useful outside-in signal and attestation.
They do not produce a portfolio funding order or verify the risk reduction after a fix.GRC, SIEM, and point tools
Strong systems of record, detection, and workflow.
They do not give every company one comparable financial risk currency for the IC.Periodic consulting and manual monitoring
Useful for bespoke review and point-in-time depth.
It is harder to enforce one portfolio mandate, keep owners aligned, and rerun the same decision record as evidence changes.Current design-partner capability. Supported evidence is required, and human approval remains mandatory for regulated or production-impacting actions.
Design partnership
Bring one portfolio decision.
Leave with a defensible funding order.
Engagement modelCapacity-capped
Capacity-capped, founder-led. Not a public seat counter.
Adil Karam · Founder & CEO
You’ll work directly with me. Every application gets a personal reply. LinkedIn
Prefer email? partner@valty.ai
What you get
- A scoped portfolio exposure model and constrained-budget funding order
- A review of the assumptions, confidence ranges, and evidence gaps behind it
- A claim-reviewed Proof Pack you can circulate internally
What we get
- Structured feedback at the model review and Proof Pack review
- Permission to use anonymized learnings only when separately approved
Best fit · PE operating or technology leaders with existing findings and a live funding decision
Free starting points
Not ready to apply? Start with a real number.
Start with a concrete output or a review path, with no demo and no sales call. When the evidence earns attention, a founder-led design-partner sprint is the next step.
Free tool · No sales call
Board Cyber Brief
Generate a board-ready narrative that translates your security posture into EBITDA impact, peer benchmarks, and recommended actions. No heatmaps. Just dollars.
Generate BriefFree tool · No sales call
EU AI Act Assessment
Map your AI systems against EU AI Act requirements, identify high-risk classifications, and see the documentation gaps you need to close.
Start AssessmentDesign-partner scope · Human governed
AI Governance Readiness
Map AI systems, agents, owners, supporting evidence, and required human approvals. See what is ready for review and what remains unsupported.
Review ReadinessCommon objections
Questions buyers ask before they engage.
These are the real questions a CISO, CFO, or PE operating partner asks about a cyber-risk platform that translates exposure into EBITDA impact. Answered directly, with the same claim discipline the product enforces.
Is the dollar number actually defensible?
Every financial output Valty produces carries four fields visible at the point of use: method, confidence band (P10 / base / P90), source coverage, and freshness date. The number is not decorative. It is a decision-support estimate built on a FAIR-aligned Monte Carlo model that shows its assumptions rather than burying them in a disclaimer.
What “defensible” means in practice: the EBITDA bridge shows which control gaps drive the exposure, what probability and magnitude assumptions underlie each scenario, and what the evidence coverage is for each assumption. A CFO or board reviewer can challenge any individual driver directly, rather than needing to accept or reject a headline figure on faith.
The model does not claim precision it cannot earn. Outputs are labeled decision-support estimates. When source coverage is thin, Valty keeps the gap visible, can widen the model-version-specific uncertainty treatment, names the next evidence source to connect, and can block the claim from publication rather than silently publishing it.
What do you need to install, and what access does this require?
Valty works from available evidence. It does not require a new scanner, agent install, or privileged shell access to your production environment. The typical starting point is read access to the evidence sources you already operate: a scanner export, a GRC control export, a cloud security posture signal, or an identity and findings feed.
The platform ingests, normalizes, and enriches what is already there, and sits above your systems as a translation layer. Getting started does not require replacing them. Source adapters are scoped by the customer; data flows into Valty on the terms you define, not ours.
In the design-partner stage, the integration is co-designed with your team. We map which evidence sources cover which control domains, agree on freshness thresholds and owner assignments, and scope the connector surface to exactly what the proof motion needs, and nothing more.
How is this different from a GRC tool or a security rating?
Security ratings (BitSight, SecurityScorecard, etc.) score your external attack surface from the outside. They are fast and comparative, but they do not see your control verification state, your internal finding remediation status, or what the exposure means for EBITDA.
GRC platforms (ServiceNow, Archer, Tugboat Logic, etc.) track control frameworks, policy compliance, and audit workflows. They are the authoritative control register. What they rarely do is translate verified control gaps into a financial impact estimate a CFO or board can act on, or rank remediation priorities by modeled exposure reduction per dollar rather than framework weight.
Valty is a translation layer, not a competitor to either. It reads from your GRC and your scanner, maps control gaps to financial exposure scenarios using a FAIR-aligned model, ranks remediation by modeled exposure reduction per dollar spent, and packages the result as a board-ready proof artifact with source, confidence, and freshness visible. The GRC is still the control record. The rating is still the external signal. Valty is the business-impact layer above both.
Do you store our security data, and who owns it?
Your source-of-truth systems stay yours. Valty does not become the record system for your controls, findings, cloud posture, identity state, or financial model. Those remain in the systems you already operate.
Valty normalizes evidence from those systems into a proof object, a structured artifact that links the claim, the source, the confidence, the freshness, and the publication state. That proof object is tenant-isolated within your Valty workspace. No cross-tenant evidence exposure. No shared inference across accounts.
Data residency, retention periods, and subprocessor scope are addressed in the vendor security questionnaire and NDA, which are part of every design-partner onboarding. We do not publish detailed subprocessor lists without a reviewed trust-center artifact behind them. Contact security@valty.ai for the current security posture package.
You do not publish customer logos or references. Why should we trust this?
Valty has an active confidential design partnership, but does not publish the partner's identity or engagement specifics. We do not turn confidentiality into implied payment status, customer-authorized production scope, source authorization, or customer outcomes.
The current proof ladder is explicit. Valty's own internal production use provides operational evidence for the control, evidence, and governance workflows. An active confidential design partnership adds external validation. The authenticated illustrative demonstration shows the product path safely, but is not production or customer-outcome proof.
What buyers can evaluate directly is the deployed product, published methodology, inspectable proof model, and stage-labeled scenario library. Paid/customer outcomes, portability, and willingness to pay require separate evidence and are not represented here.
Stage-honest positioning is a constraint we enforce technically: the product’s claim-gate blocks unsupported assertions from being published in proof packs. We apply the same discipline to our own marketing copy.
Design partner
Know where cyber exposure is concentrated.
Fund what changes it most.
Bring the findings you already have. Valty makes them comparable, turns them into a reviewable funding order, and keeps the proof behind every recommendation attached.