How much risk are we carrying?
Estimate expected annual loss and tail exposure by scenario rather than compressing uncertainty into a single color or score.
Open source · MIT licensed
Cyber P&L: Open-Source Cyber Risk Quantification
Transparent Monte Carlo loss modeling for CISO–CFO decisions, control valuation, risk appetite, and security investment prioritization.
Cyber P&L: model the decisions
Open source · MIT licensed
Cyber risk quantification for CISO–CFO decisions. FAIR-style loss analysis and Monte Carlo simulation.
- Loss exceedance curves
- Control counterfactuals
- Risk appetite tests
- Net ROSI
- Governed assumptions
Annual loss exceedance: probability of exceeding each annual-loss amount, from 100% toward 0%. The illustrative curve marks p95 near the 5% exceedance tail; 10 scenarios, Monte Carlo simulated.
v0.1.1Public, versioned release
FAIR-styleTransparent loss analysis
Monte CarloRanges, tails, and uncertainty
Governed inputsOwners, sources, and attestations
The decision problem
Turn cyber risk into decisions leaders can examine
Heat maps can help organize a conversation, but they cannot tell a CISO, CFO, risk committee, or board what a bad year could cost, whether a proposed control changes that exposure, or which investment deserves priority.
Cyber risk quantification estimates the frequency and financial magnitude of cyber loss scenarios so leaders can compare exposure, risk appetite, control value, and security investments on a common economic basis.
Which controls change the outcome?
Model control counterfactuals, dependencies, annualized cost, loss avoided, net ROSI, and payback without pretending effects are additive.
Are we inside risk appetite?
Test every approved loss threshold and expose the evidence, owner, assumptions, and model limits behind the result.
Illustrative decision output
Give leadership a range, not a false promise
The bundled demonstration is a fictional $180M SaaS company. It shows how a governed model can place annual loss, bad-year exposure, appetite, and assumption status in one reviewable statement.
Every number below is an illustrative template—not a benchmark or forecast for another organization.
Cyber P&L · Example SaaS Inc. · 20,000 simulated years
Expected annual loss$1.36M
Bad year (p95)$4.31M
Severe tail (p99)$7.89M
Risk appetite checksWithin
Assumption status remains incomplete until the required evidence and organization-specific attestations are supplied.
Reading a loss exceedance curve
A loss exceedance curve shows the probability that annual cyber loss will exceed each financial threshold. Moving from left to right, the curve makes expected loss and tail exposure visible without reducing uncertainty to a single score.
Leaders can use the curve to compare modeled exposure with risk appetite and examine how a control or investment changes the distribution. The result remains decision support—not a forecast—and is only as reliable as the scenarios, evidence, ranges, and dependencies behind it.
Cyber P&L example decision statement
Fictional Example SaaS Inc. · FY2026 · 20,000 simulated years. Template values for demonstration, not a benchmark or forecast.
Expected annual loss
$1.36M · 0.76% of revenue.
Bad year · p95
$4.31M · 1-in-20 year · 2.40% of revenue.
Security spend
$5.40M · 4.0× expected loss.
Risk appetite
Within · p95 ≤ $9.00M; expected annual loss ≤ $2.70M.
Assumption status: TEMPLATE. Synthetic KPI inputs: time to contain 32.0 minutes; credential exposure score 34.0; proven restore time 6.0 hours. Generated 15 September 2026.
Loss exceedance curve
Probability that annual loss exceeds X. Median: $841K; 1-in-20 year: $4.31M. The displayed annual-loss axis spans $0–$8.90M.
Read all 10 scenario values
Regulatory or audit failure without a breach
- Expected annual loss
- $286K
Extended platform outage from misconfiguration
- Expected annual loss
- $221K
Software supply-chain compromise of the build pipeline
- Expected annual loss
- $193K
Insider data theft by departing employee
- Expected annual loss
- $190K
Critical third-party / SaaS provider outage
- Expected annual loss
- $123K
Business email compromise via executive account
- Expected annual loss
- $99K
Ransomware on the production platform
- Expected annual loss
- $98K
Customer data breach via stolen credentials
- Expected annual loss
- $75K
Cloud account compromise (leaked key)
- Expected annual loss
- $72K
DDoS on the customer portal
- Expected annual loss
- $8K
Read existing control values
Remove one control, re-simulate with stable matched streams, measure the difference; dependents are removed with it.
EDR on endpoints and servers
- Annual cost
- $420K
- Loss avoided / year
- $760K
- Bad-year (p95) reduction
- $3.76M
- Benefit / cost
- 1.8×
- Net ROSI
- 0.8×
Pre-authorized containment (The 72-Minute Defense)
- Annual cost
- $60K
- Loss avoided / year
- $521K
- Bad-year (p95) reduction
- $3.27M
- Benefit / cost
- 8.7×
- Net ROSI
- 7.7×
MFA on workforce identities (app-based, ~85% coverage)
- Annual cost
- $90K
- Loss avoided / year
- $431K
- Bad-year (p95) reduction
- $1.53M
- Benefit / cost
- 4.8×
- Net ROSI
- 3.8×
Developer credential hygiene program (wormprint audits)
- Annual cost
- $25K
- Loss avoided / year
- $280K
- Bad-year (p95) reduction
- $852K
- Benefit / cost
- 11.2×
- Net ROSI
- 10.2×
Change control and drift detection
- Annual cost
- $50K
- Loss avoided / year
- $147K
- Bad-year (p95) reduction
- $161K
- Benefit / cost
- 2.9×
- Net ROSI
- 1.9×
Vendor risk tiering and contractual SLAs
- Annual cost
- $80K
- Loss avoided / year
- $36K
- Bad-year (p95) reduction
- $37K
- Benefit / cost
- 0.4×
- Net ROSI
- −0.6×
Managed DDoS protection
- Annual cost
- $60K
- Loss avoided / year
- $31K
- Bad-year (p95) reduction
- $35K
- Benefit / cost
- 0.5×
- Net ROSI
- −0.5×
Immutable backups with quarterly restore drills
- Annual cost
- $140K
- Loss avoided / year
- $23K
- Bad-year (p95) reduction
- $118K
- Benefit / cost
- 0.2×
- Net ROSI
- −0.8×
Control values are one-at-a-time counterfactuals. They overlap and must not be summed.
Read proposed investment rankings
Ranked by benefit:cost ratio in this example.
Dual-control and callback verification for payments above 25k in model currency
- Annualized cost
- $18K
- Loss avoided / year
- $63K
- Bad-year reduction
- $202K
- Benefit / cost
- 3.5×
- Net ROSI
- 2.5×
- Payback
- 2 months
CI hardening: dependency pinning, OIDC trust review, runner isolation
- Annualized cost
- $33K
- Loss avoided / year
- $106K
- Bad-year reduction
- $550K
- Benefit / cost
- 3.2×
- Net ROSI
- 2.2×
- Payback
- 6 months
Phishing-resistant MFA (passkeys/FIDO2) for all workforce
- Annualized cost
- $85K
- Loss avoided / year
- $237K
- Bad-year reduction
- $801K
- Benefit / cost
- 2.8×
- Net ROSI
- 1.8×
- Payback
- 8 months
Eliminate static cloud keys (workload identity, short-lived credentials)
- Annualized cost
- $37K
- Loss avoided / year
- $52K
- Bad-year reduction
- $46K
- Benefit / cost
- 1.4×
- Net ROSI
- 0.4×
- Payback
- 23 months
DLP expansion to SaaS and endpoints
- Annualized cost
- $110K
- Loss avoided / year
- $70K
- Bad-year reduction
- $139K
- Benefit / cost
- 0.6×
- Net ROSI
- −0.4×
- Payback
- —
SIEM replacement with expanded log coverage
- Annualized cost
- $483K
- Loss avoided / year
- $49K
- Bad-year reduction
- $127K
- Benefit / cost
- 0.1×
- Net ROSI
- −0.9×
- Payback
- —
Read the sensitivity analysis
Assumptions that move expected loss most when set at their low versus high ends. Baseline: $1.34M. The chart labels summarize the spread shown; spend calibration effort here.
Insider data theft — competitive loss percentage
- Displayed spread
- ±$305K
Third-party outage — breach notification…
- Displayed spread
- ±$290K
Regulatory / audit failure — frequency
- Displayed spread
- ±$289K
Regulatory / audit failure — lost deals percentage
- Displayed spread
- ±$282K
Platform outage / misconfiguration — frequency
- Displayed spread
- ±$222K
Supply-chain pipeline — frequency
- Displayed spread
- ±$221K
Platform outage / misconfiguration — SLA credits percentage
- Displayed spread
- ±$188K
Platform outage / misconfiguration — downtime hours
- Displayed spread
- ±$180K
Insider data theft — frequency
- Displayed spread
- ±$165K
BEC / executive — fraud loss amount
- Displayed spread
- ±$152K
Read consequences not assigned a number
- Ransomware: executive time and morale; delayed roadmap; regulatory scrutiny beyond fines.
- Customer data breach: loss of enterprise deals in pipeline; board and investor confidence.
- Executive BEC: material non-public information exposure; executive reputational harm.
- Supply-chain pipeline: trust with the developer community; regulatory attention as a vendor.
- Insider data theft: team morale after a departure investigation.
- Third-party outage / breach: customer perception even when the fault is the vendor’s.
Cyber P&L is a cyber-risk decision-support estimate, not an accounting or GAAP P&L. Model ranges reflect calibrated judgment and cited sources; actual losses may fall outside them. Materiality determinations remain management’s responsibility. Loss frequency × loss magnitude; Monte Carlo; stable matched streams for counterfactual attribution.
Three practical use cases
Where Cyber P&L supports executive decisions
Security investment prioritization
Compare proposals using loss avoided, benefit-cost ratio, net ROSI, payback, and change in p95 exposure.
- Build a defensible business case
- Separate cost from value
- Show uncertainty explicitly
Board and risk-committee reporting
Translate technical scenarios into financial ranges, appetite tests, decision ownership, and documented model limitations.
- Connect cyber risk to enterprise risk
- Make assumptions reviewable
- Support CISO–CFO alignment
Control valuation and assurance
Remove a control and its declared dependencies, then rerun the model with stable, independently seeded input streams.
- Estimate existing-control value
- Test replacements and dependencies
- Connect operational evidence to risk
How it works
A transparent path from scenario to decision
STEP 01Define scenariosDescribe service, threat, event frequency, and CFO-recognizable loss components.
STEP 02Calibrate rangesReplace the fictional inputs with internal evidence, accountable owners, and dated sources.
STEP 03Simulate lossRun Monte Carlo analysis to estimate annual loss and exceedance probabilities.
STEP 04Test decisionsCompare appetite, controls, counterfactuals, proposals, payback, and tail reduction.
STEP 05Govern the modelValidate schemas, evidence, sources, owners, dependencies, and required attestations.
Trust model
Open assumptions are a control—not a weakness
What the project makes inspectable
- Scenario and business assumptions
- Input owners, sources, dates, and evidence status
- Control dependencies and replacements
- Risk-appetite thresholds and decision outputs
- Model limits and endpoint sensitivity
What the project does not claim
- No universal breach-cost benchmark
- No certified FAIR or Open FAIR conformance
- No actuarial, accounting, insurance, legal, or investment advice
- No readiness claim before organization-specific evidence and approval
- No promise that uncertain inputs become facts
Important: Cyber P&L ships as a structurally valid illustrative template. A real organization should not use its output for executive decisions until its own evidence, accountable owners, model review, and required attestations pass operational validation.
Apply the method
Explore the model
Start with the repository documentation and the fictional example to understand the inputs, assumptions and outputs. Before applying the model to an organization, replace the sample inputs with relevant evidence, assign accountable owners and review the model’s limitations and validation requirements.
Cyber P&L makes the reasoning behind a risk estimate inspectable. The value is in examining the assumptions and decisions, not treating an illustrative result as a forecast.
About the creator
Created by Jessen Kurien
Jessen Kurien is a cybersecurity leader, author and speaker with 18+ years across security operations, incident response, threat intelligence and detection engineering. During nearly 15 years at Microsoft, he was part of the founding team of the Microsoft Threat Intelligence Center and later led detection engineering in Microsoft Defender XDR. His experience combines complex investigations, technical direction and the development of security teams. His public work includes The Defender’s Guide to AI Agents, research articles and open-source tools for cyber defense and risk decisions.
Frequently asked questions
Cyber risk quantification questions
What is Cyber P&L?
Cyber P&L is an open-source Python project that uses FAIR-style loss analysis and Monte Carlo simulation to support cyber risk, control, appetite, and security-investment decisions.
Is Cyber P&L a financial statement?
No. It is not an accounting or GAAP profit-and-loss statement, actuarial model, insurance model, forecast, or substitute for professional financial, legal, or investment advice.
How does it support CISO–CFO communication?
It expresses cyber scenarios using financial ranges, tail exposure, risk appetite, control economics, evidence ownership, and explicit model limits instead of relying only on technical scores.
Does it implement FAIR?
It uses a FAIR-style loss-event frequency and loss-magnitude approach. It is not affiliated with, certified by, or endorsed by The Open Group and does not claim Open FAIR conformance.
Can organizations use the sample results?
No. The bundled company, costs, controls, measurements, and results are fictional. Organizations must replace them with scoped evidence, accountable owners, review, and required attestations.
What should a team review before using the model?
Review the decision being evaluated, the relevance and quality of the input evidence, the loss scenarios, control dependencies, risk-appetite thresholds, accountable owners and documented model limits. Complete the project’s validation and attestation requirements before using outputs to inform organizational decisions.
Examine the assumptions behind a cyber-risk decision
Explore the source, documentation and illustrative example to understand how the model works and where its limits apply.