2. Current exposure

Build your library of loss scenarios first, then mark which ones apply to this analysis — keep them mutually exclusive and collectively exhaustive for the scope you defined.

Add a loss scenario

Scenario name

Description (optional)

Actor(s), action, and impact

Actor(s)

External Internal Partner

Action category (VERIS) Choose one Hacking Malware Social Misuse Error Physical Environmental

Action detail (optional)

Impact(s)

Confidentiality Integrity Availability

Applies to this analysis

Notes / assumptions (optional)

Rate of occurrence

Expected frequency Choose one Multiple times pr. year A couple of times pr. year Once every year Once every 2 years Once every 5 years Once every 10 years Once every 20 years Once every 50 years Once every 100 years

Confidence Choose one Pretty sure Somewhat sure Unsure

Lower confidence widens the simulated range around your expected frequency.

Cost per loss event

Typical (median)

Severe (95th percentile)

Secondary loss (optional)

Probability of secondary loss, given a loss event (%)

Secondary cost — typical

Secondary cost — severe

Duration & records exposed (optional, reported only — not used in the RoI calculation)

Duration typical (days)

Duration severe (days)

Records typical

Records severe

Add scenario