Methodology
Defensible numbers, not magic numbers.
A risk estimate is only useful if the reader can understand it, challenge it and repeat it. That is why inputs, factors, assumptions and limits are part of the result.
The logic
How an estimate is built.
The model is deterministic and reproducible by default: same inputs, same result.
Summary formula. Annual revenue × calibrated loss rate, as a function of threat, sector, controls, exposure and assets.
- Annual revenue normalized to euro
- Severity and sector multipliers
- Threat-specific profile
- Criticality and quantity of the assets involved
- Exposure and control maturity
- Annualized probability of the scenario
- Country, continuity and compliance parameters
Reading the results
What each number means.
Risk score
An index from 0 to 100 classified as Info, Low, Medium, High or Critical. It is used to prioritize scenarios: it is not the mathematical probability that the incident will occur.
Annualized probability
An estimate of how plausible it is that the scenario occurs within a year, in the context provided.
Annualized expected loss (ALE)
Average expected loss on a yearly basis, combining probability and impact.
Contained scenario
Lower planning bound: the most contained loss among those considered.
Central scenario
The probable loss of the model, the reference for discussion.
Severe scenario
Upper planning bound, to size coverage and continuity.
Confidence score. It indicates how complete and specific the inputs provided are. It is not a guarantee of absolute accuracy: the more detailed the context, the better informed the estimate.
Governance and calibration
A model that can be verified over time.
The governance profile records identifier and version, approval status, date of the last calibration, data source, declared limitations and acceptance thresholds.
Backtesting
The workflow accepts operator-controlled JSON or CSV datasets with predicted and observed losses. It computes sample size, MAE, RMSE, MAPE, normalized mean error and normalized bias. The evidence produced contains only aggregate metrics, with declared provenance and the SHA-256 hash of the dataset for repeatability, without replicating the observations.
- Formal approval by an authorized owner
- Fail-closed mode: blocks production start if approval or calibration are missing or expired
- The default profile stays explicitly unapproved until validated with real data
| Default threshold | Value |
|---|---|
| Minimum observations | 30 |
| Maximum MAPE | 35% |
| Maximum normalized MAE | 25% |
| Maximum absolute normalized bias | 15% |
Initial configurable policies, not certifications of universal accuracy.
Correct uses and limits
A support tool, not an oracle.
- To compare scenarios, order priorities and justify investments
- To communicate risk in a language shared by engineers and leadership
- To be interpreted together with the organization's context and validated with internal data, incident history, insurance information, sector benchmarks and up-to-date threat intelligence
Estimates are directional and depend on the inputs and assumptions of the model. They are not a forensic report, legal opinion, certain forecast, compliance certification or financial reporting. Regulatory, legal, insurance or financial decisions require qualified professionals.
FAQ
Questions about the model.
Does Exploit2Impact predict whether an attack will happen?
No. It estimates probability and impact to support the comparison of scenarios. It does not predict future events with certainty.
Are the figures guaranteed losses?
No. They are directional estimates based on the inputs and assumptions of the model and do not replace a forensic report or a certified financial assessment.
How is it different from CVSS?
CVSS describes the technical severity of a vulnerability. Exploit2Impact adds the business context and translates the scenario into possible consequences for the business.
Is AI mandatory?
No. It is an optional extension for narratives and recommendations. The risk engine works without LLM services.
Does it support GDPR and NIS2?
It produces indicators and scenarios oriented to these contexts. It does not certify compliance and does not replace legal advice or formal regulatory assessments.
Can the model be calibrated?
Yes. Backtesting checks configurable thresholds on operator-controlled data. For production use, multipliers should be compared with relevant incident, insurance and benchmark data, with formal approval by an authorized owner.