Blog
Cyber loss exposure
Translating verified control posture and findings into a P10–P90 loss-exposure range, net of insurance, that a CFO or operating partner can challenge.
Cyber loss exposure / 9 min read / 2026-04-15
CVSS Tells You Severity. It Won't Tell You What to Fix First.
Why a CVSS 9.8 on a forgotten asset can matter less than a CVSS 6 on a revenue-critical path, and how ranking findings by EBITDA recovered per dollar reorders the backlog.
Cyber loss exposure / 9 min read / 2026-03-26
From finding to EBITDA with Proof
The full buyer path: a raw security finding mapped to the asset and revenue it exposes, priced as EBITDA-impacting cyber loss exposure, ranked by recovery per dollar, funded, and closed with board-ready proof.
Cyber loss exposure / 9 min read / 2026-03-12
FAIR for Security Leaders: Turning Controls Into a Dollar Range
A plain-language guide to Factor Analysis of Information Risk, the Monte Carlo behind a P10/base/P90 loss estimate, and how a CISO uses it to defend a budget without overclaiming.