What risks are we worried about?
A year's losses are over your tolerance from €1.2M up
Data breach is the biggest risk: 50% of the expected loss. Expected loss is €1.6M a year in total. 16% of years pass your once-in-20-years limit (€3M); you accept 5%.
Against your tolerance, in one year
- Almost every year you accept losing more than €200k. Today that happens in 57% of years.
- Half the years you accept losing more than €800k. Today that happens in 38% of years.
- Once in 20 years you accept losing more than €3M. Today that happens in 16% of years — over your tolerance.
- Whole curve: Over your tolerance from €1.2M up.
Scope
Illustrative example scenario for demo purposes -- insider and external data exposure risk, evaluated against security tooling investment.
EUR · 3-year horizon
Loss tolerance
€3,000,000 a year, about once in 20 years
Shaped as a curve: €200,000 almost every year, €800,000 half the years
Loss scenarios
Insider data exfiltration Exp. loss €310,875/yr
| Rate of occurrence | Once every 5 years (Somewhat sure) |
| Primary loss | €350,000 typical / €3,500,000 worst case |
| Secondary loss | 60.0% chance — €300,000 / €4,000,000 |
| Records | 2500–1800000 |
| Actor(s) | Internal |
| Action | Misuse |
| Impact(s) | Confidentiality |
Data exposure Exp. loss €514,840/yr
| Rate of occurrence | Once every year (Somewhat sure) |
| Primary loss | €100,000 typical / €1,500,000 worst case |
| Secondary loss | 30.0% chance — €200,000 / €1,500,000 |
| Records | 20–15000 |
| Actor(s) | Internal |
| Action | Error |
| Impact(s) | Confidentiality |
Data breach Exp. loss €821,170/yr
| Rate of occurrence | Once every 5 years (Somewhat sure) |
| Primary loss | €1,500,000 typical / €8,000,000 worst case |
| Secondary loss | 75.0% chance — €1,000,000 / €7,500,000 |
| Records | 3500–200000 |
| Actor(s) | External |
| Action | Hacking Social |
| Impact(s) | Confidentiality |