Risk-to-Dollars Translation Lab
A scanner says CVSS 9.8. The board says so what, in dollars? This is the hard part of the job: turning a technical finding into a number a board can act on. Sit in the risk lead’s seat and make each call the way a skeptical board would judge it — risk is loss event frequency × loss magnitude, expressed as a calibrated range rather than false precision or a heatmap colour; you decide on residual risk, tie every risk to the board’s stated appetite, and escalate only what breaches it — with the treatment and its cost on the slide. Each decision shows you why.
Pair this drill with the free Board Cyber Risk Register (Quantified) — the document that records the quantified picture you practise presenting here. Educational drill, not professional risk advice.
The real job. More noise, a tighter clock.
You are the risk lead taking the cyber risk picture to a skeptical board. Work 10 board-room decisions — translate each technical finding into a defensible loss range tied to the board’s appetite, then see why it lands. You are graded on how many you call correctly against the clock.
What this lab is
- A free, browser-based decision drill on translating technical security findings into board-ready financial risk: work ~14 board-room decisions on how to quantify and present cyber risk so a skeptical board can act on it.
- The core frame is FAIR-lite — risk = loss event frequency × loss magnitude — expressed as a calibrated loss RANGE, not a single false-precise number and not a red/amber/green heatmap colour.
- You practise the real traps: translating a CVSS finding into dollars, avoiding vanity precision ($4,237,812), deciding on residual rather than inherent risk, tying each risk to the board’s stated appetite, and knowing what to escalate versus simply report.
- Each decision reveals why the defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not professional risk advice. Pair it with the free Board Cyber Risk Register (Quantified) template.
Frequently asked questions
What is the Risk-to-Dollars Translation Lab?
A free, in-browser decision simulation that puts you in the seat of the risk lead presenting cyber risk to the board. You work through board-room decisions — how to present a CVSS finding, whether to give a single number or a range, how to tie a risk to appetite, what to escalate — and each one has a single defensible answer under a FAIR-lite quantification frame, revealed after you lock in your call.
What is FAIR-lite risk quantification?
FAIR (Factor Analysis of Information Risk) models risk as loss event frequency × loss magnitude: how often a loss event is expected, times how much it costs when it happens. "FAIR-lite" uses that structure without the full formal model — calibrated ranges and a few decomposed factors — to produce a defensible dollar figure instead of an ordinal 1–5 score or a heatmap colour.
Why a loss range instead of a single number?
Real risk is a distribution, not a point. A single precise figure (especially one like $4,237,812 built on rough assumptions) implies a confidence the data does not support and collapses the moment an assumption is questioned. A calibrated range — for example a 10th-to-90th-percentile band with the most-likely value marked — communicates both the estimate and its uncertainty honestly.
Is this professional risk advice?
No. The lab is an educational drill. The FAIR concepts and quantification techniques are summarised for orientation; apply them to your own context, data and risk framework, and confirm board-reporting decisions with your risk and governance functions.