Pricing your bad days and how to build an economic model for security decisions
A Qualys executive explains how CISOs can price loss scenarios to guide security spending.
Ivan Milenkovic, VP Risk Technology EMEA at Qualys, argues CISOs should build economic models from a handful of painful loss scenarios instead of vulnerability scores. He says remediation should be ranked by value at risk, so a severe flaw on an unused server ranks below a moderate flaw on a revenue system. The interview covers what CFOs expect, how to express the value of incidents that never happened, and using one model for boards and cyber insurers. He also notes one frontier model surfaced more than 6,000 candidate high- or critical-severity flaws across over 1,000 open-source projects.
- Start with a few costly loss scenarios, then map the assets that drive them.
- Rank fixes by value at risk rather than raw vulnerability scores.
- CFOs want residual cyber risk compared with insurance and cash limits.
- An unnamed frontier model reportedly found over 6,000 candidate severe flaws.
From the original article
8 min read at helpnetsecurity.com
Ivan Milenkovic, VP Risk Technology EMEA at Qualys, explains how security leaders can build an economic model that puts money behind their decisions. He suggests starting with a few loss scenarios, then working down to the assets that drive them. He covers how to rank fixes by value at risk, what CFOs expect to see, and how to show the worth of incidents that never happened.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.