Dynamic ROSI & Capital Allocation
Cyber Capital Lab
A new vulnerability. An uncertain exposure. Explore the financial consequences before choosing a response.
Your businessNorthstar Manufacturing
Fictional UK manufacturer · £120m revenue
Illustrative figures, not a risk assessmentStage 1 of 5 · Baseline
The situation
KNOWN POSITION
An ordinary week. A consequential dependency.
Supplier engineers use remote access to support the plant. Controls are in place, but the dependency between the gateway and production has not been fully verified.
What changed?
No new intelligence. Establish the starting estimate before a decision is needed.
Evidence: asset inventory + prior assessment1.5%Baseline loss-event probability over 72 hours. Start the scenario or compare a response.
Probability of exceeding a loss amount
Gross cyber loss · next 72 hours · probability on Y axis
Current evidence · waitSelected response
Gross cyber loss (GBP)
X axis: £0–£9m · Normal production.
Explore likelihood and loss severity
Will a loss event happen in the next 72 hours?
Original baseline1.5%
Current evidence · wait1.5%
Selected response1.5%
Selected response: 98.5% probability of no cyber loss event. This does not exclude planned interruption costs.
If a loss event happens, how costly could it be?
£150.0k65%
£1.50m30%
£8.00m5%
Gross loss outcomes conditional on an event. These weights sum to 100%; they are not the probability that an event happens. The graph is before insurance and excludes planned response and interruption costs.
How does the exposure change?
Expected retained cyber loss · next 72 hours
● Central estimate━ Illustrative assumption range
Original baseline£8.2k
£2.7k to £19.2k · assumption sensitivity
Current evidence · wait£8.2k
£2.7k to £19.2k · assumption sensitivity
Selected response£8.2k
£2.7k to £19.2k · assumption sensitivity
£0£50k£100k£150k£200k
Axis: £0–£200k · Insurance enabled. Fixed across stages, responses and peak production.
Chance of gross cyber loss above £1m · 72 hours
Wait 0.5%Selected 0.5%
No change from waiting. Baseline: 0.5%.
What does the shaded range mean?
It is a sensitivity range for the expected loss estimate, not the range of possible incident losses or a statistical confidence interval. Endpoints use illustrative low and high loss-event probabilities while holding severity and response effectiveness fixed. No Monte Carlo simulation is used.
Baseline probability: 0.5–3.5% (central 1.5%). Current stage: 0.5%–3.5% (central 1.5%). Selected response multiplies all current probability estimates by 1.
Disclosure widens the probability assumptions; investigation narrows them. These are authored scenario assumptions, not calibrated measurements. Insurance and peak production apply equally to all three comparisons. The baseline retains its original event probability.
Range = sensitivity to probability assumptions. It does not show a worst-case loss. Planned response costs are shown separately below. Insurance reduces retained loss, not attack probability.
Financial exposure
Follow the money
Expected cost comparison · next 72 hours
Wait: retained cyber loss£8.2k
Selected: retained cyber loss£8.2k
Selected: response + interruption£0.0k
Waiting has no planned interruption cost, but retains the modelled cyber exposure. Compare another response to see the trade-off.
The next financial year
A separate planning horizon. Editing baseline costs changes programme spend, not probability, package effectiveness or package ROSI.
Current annual security spend£1,200,000
Enter £0–£10m per field. Invalid entries keep the last valid amount in the totals.
Additional first-year cost£0.0k
Annual expected loss reduction£0.0k
First-year ROSINot applicable
Total first-year programme spend£1.20m
Baseline annual retained loss: £219.0k. With package: £219.0k.
Baseline: 0.4 loss events per year for this supplier-access scenario. This is not whole-business cyber exposure.
These are planning assumptions, independent of the incident stage and response above. Peak production and insurance settings apply to both views. Package assumptions already account for overlap; individual benefits are not added together.
Look beneath the number
Every figure should have a reason. Inspect the assumptions before trusting the result.
What drives this scenario?
- Loss-event probability over 72 hours: 1.5% before the selected response; 1.5% afterwards.
- Conditional gross loss outcomes: £150,000 (65.0% weight); £1,500,000 (30.0% weight); £8,000,000 (5.0% weight).
- Production interruption: £30,000 per hour, used for planned containment. Cyber-loss outcomes already include their own interruption estimate.
- Peak production adds £50k / £800k / £5m to the three gross outcomes; it does not double total cyber loss.
- No probability is derived automatically from a CVSS score, budget amount or network route.
- All probabilities, loss weights and control effects are deliberately illustrative. No live telemetry or calibrated evidence is connected.
Insurance and retained loss
For each cyber loss outcome: £250k excess, 80% recovery above the excess, capped at £2m per modelled event. Planned containment interruption and response spend are not covered in this model. Recovery is assumed to be paid; annual aggregate limits, timing and coverage disputes are not simulated.
The premium budget and coverage toggle are independent in this version. Editing the premium does not change cover. For annual packages, severity is adjusted before insurance is applied to each event outcome.
Model boundaries and FAIR
This is a simplified educational model, informed by FAIR’s separation of loss frequency and magnitude. It is not a complete or certified FAIR, FAIR-CAM or FAIR-MAM implementation.
The 72-hour model permits at most one loss event, with three severity outcomes. Annual planning uses an illustrative event frequency and the same loss outcomes. These horizons are calculated separately. No CVSS-to-probability conversion or live threat feed is used.
Attack-path evidence revises assumptions. It does not prove an attack probability. Safety, authorisation and recovery constraints require separate evaluation. This fictional simulation does not assess an organisation, execute controls or provide insurance advice.
FAIR-CAM: control effectsFAIR-MAM: financial consequences
How net benefit and ROSI are calculated
72-hour net benefit = expected retained cyber loss avoided − intervention spend − planned interruption cost. It can be negative.
First-year ROSI = (annual expected retained loss reduction − additional first-year cost) ÷ additional first-year cost. Current programme spend is shown separately. Benefits are estimates, not cash savings. Combined controls are modelled jointly rather than adding individual benefits.