No simulation has been run yet.
The dashboard shows risk posture, decision confidence,
and top priorities after the first run.
Enterprise EAL
—
Portfolio Monte Carlo — joint annual loss
Decision Confidence
—
—
P95 Exposure
—
Severe but plausible annual loss
—
Why can the security views rank areas differently?
Operational Defense CapabilitiesWhat can we reliably do? Weighted mapped posture and its supporting breadth — not a maturity score or monetary ranking.
NIST CSF OrientationWhere is the current security emphasis? Monetary reduction placed in Govern, Identify, Protect, Detect, Respond and Recover.
Strategic Lever AttributionWhere does current modeled reduction come from? Monetary contribution from active control groups — not the next investment recommendation.
Different rankings are expected. A capability can be well established while another control group contributes more money to current risk reduction. Recommended next actions are a fourth, forward-looking decision view.
Evidence-informed perspective
—
Operational Defense Capabilities
What can we reliably do? Weighted coverage of mapped controls, with breadth
shown separately. This is not NIST maturity and not monetary Strategic Lever attribution.
Suggested next actions
Top Priority Scenario
—
—
—
Overall Risk Assessment
—
—
—
—
Enterprise EAL
—
Canonical portfolio mean after overlap adjustment
P95 exposure
—
Canonical portfolio P95 — severe but plausible
Scenarios analysed
—
—
Decision Confidence
▼
—
—
Canonical risk and evidence-informed perspective
—
Operational Defense Capability Detail
What can we reliably do? Coverage is derived from mapped control status; breadth
shows how many controls support the result. Allocated materiality reuses the current
canonical run and is neither a new EAL nor a capability maturity score.
Capability-aware guidance
Why this confidence?
50% = calibrated analog (incident data from comparable organisations) · 25% = expert estimate · 0% = default assumptions · Click a scenario to see what evidence is present and what is missing.
Expected annual loss per scenario (EUR)
Scenario details
| Scenario | Mean loss | P95 loss | Mode |
|---|
Scenario Calibration Editor
Edit calibration evidence, frequency, and cost assumptions directly in the catalog. Changes are saved to the YAML file on disk.
Loading scenarios…
Decision Memory
Record the formal decision, its approved basis, and whether it remains defensible.
Select a customer and session in Workshop before using Decision Memory.
Record formal decision
Selected course
€0 selected
Select candidate or planned controls. Costs and eligibility are revalidated server-side.
Decision history
No decisions recorded for this session.
Decision detail
Available Reports
Decision Confidence
—
Available
Board Report
Executive-level risk summary with sensitivity analysis.
Identifies the parameters that most influence expected loss
and provides a recommended course of action.
Available
ROI Analysis
Ranks every control by expected risk reduction per euro invested.
Answers: "Where should I invest my security budget?"
Requires sensitivity analysis — may take a moment to generate.
Available
Gap Report
Identifies assets, threats, and vulnerabilities not covered
by any scenario, and controls without adequate efficacy evidence.
Useful for model completeness reviews.
Available
DORA Compliance Report
Evidence-oriented assessment against Regulation (EU) 2022/2554.
Shows obligations, applicability, assessment criteria, canonical
control mappings, evidence gaps and prioritised actions.
Available
Portfolio Report
Aggregated portfolio view: total mean and P95 risk,
concentration metrics, and scenarios ranked by expected
annual loss.
Available
Decision Confidence Report
Full confidence breakdown — evidence chain per scenario,
calibration quality, and a concrete next step for improving
the evidence base of each scenario.
Available
Investment Plan
Budget-constrained deployment sequence — ranked by marginal ROI
with diminishing-returns re-simulation at each step.
Enter an annual budget and click View.
Available
Decision Justification
Executive-grade control justification — risk reduction, ROI,
per-scenario impact, confidence rating, and evidence audit.
Select a control and click View.
Available
Driver Analysis
Sensitivity analysis for a single scenario — control drivers,
cost-effectiveness, vulnerability drivers, likelihood drivers,
and assumption drivers ranked by impact.
Select a scenario and click View.
Available
Model Governance
Calibration quality assessment — scenario evidence basis,
control confidence levels, freshness audit, and prioritised
next steps for strengthening the model's evidence base.
Assessments
Import external evidence, compare it with current authoritative posture, and review the controls with greatest decision impact first.
Select a Workshop session before importing or reviewing assessment evidence.
Risk Workshop
Start from an unprotected baseline. Toggle controls to In Place, enter your actual annual cost, then run the simulation to see how your posture reduces financial exposure.
›
New Session
Saves the current workshop state as a new named session.
⓪ Business Profile
▼ expand
—
Edit
Organisation
Technology
Operations
Derived Assumptions
Enter at least annual revenue and number of employees to see estimates.
⚠ Business Profile has unsaved changes — Run Simulation saves them automatically.
ⓘ How is Gross Scenario Exposure calculated?
▶
Gross Scenario Exposure
—
P95: —
Residual Portfolio Exposure
—
P95: —
Risk Reduction
—
vs. inherent baseline
Controls In Place
—
Total spend: —
How to read the three security views
Operational Defense CapabilitiesWhat can we reliably do? Current mapped posture and breadth of supporting controls.
NIST CSF OrientationWhere is the security lifecycle emphasis? Current monetary reduction grouped by CSF function.
Strategic Lever AttributionWhere does current modeled reduction come from? Monetary contribution from active control groups.
Do not compare the percentages as if they share a denominator. Capability coverage describes posture; the waterfalls allocate modeled money. Neither waterfall is, by itself, a recommendation for the next investment.
Current Risk Reduction by Strategic Lever
Computing attribution…
Where does current modeled reduction come from? Monetary attribution across
active control groups. A large contribution describes current effect, not where the next euro should be invested.
Current Risk Reduction by NIST CSF 2.0 Function
Where is the current security lifecycle emphasis? Monetary risk reduction grouped
by Govern, Identify, Protect, Detect, Respond and Recover. This is an orientation view,
not a CSF maturity or compliance score.
→
Recommended Next Action
—
—
—
📂 —
Assessment Completeness
Coverage breadth — separate from Decision Confidence and Decision Readiness
Administrative
—
—
Material
—
—
Open assumptions
—
—
Framework Assessment Import
Import an external assessment as immutable evidence. Importing never changes control posture.
Governed comparison
Preliminary Posture Review
Review highest decision impact first. This draft never changes the authoritative posture.
Review queue
Each save appends decision evidence. Applying proposed statuses is a separate governed step.
Improve the Decision Basis
Prioritised next steps — Completeness, Confidence and Readiness remain separate signals
② Validate
— Does this model represent your organisation?
Not reviewed
Business Profile: —
Scenario catalog: —
Key adjustments: none
Decision Confidence: —
Acceptance record
What needs adjustment?
✔
Accepted for decision-making
Representative: —
Role: —
Date: —
Purpose: —
Comment: —
⚠
Needs adjustment
Area: —
⚠ Model changed since acceptance
Revalidation required.
Controls
0 in place · 0 shown
Load a catalog to see controls.
Adjustments
·
Scenario Scope
No session selected
Threat Frequency (Layer 2)
Load a catalog to adjust scenario frequencies.
CIA Impact Weights (Layer 3)
1.00×
1.00×
1.00×
Scenario Breakdown
Run a simulation to see per-scenario results.
| Scenario | Inherent | Residual | Reduction |
|---|
Generate Reports
📚 Knowledge Health
—
Loading knowledge health…
No observations found in knowledge directory.
0
FRESH
0
WARNING
0
STALE
—
AVG AGE (DAYS)
—
| ID | Type | Age (d) | Score | Tier |
|---|
—
Decision Confidence
—
Strategic Lever Explorer
Explore hypothetical control deployment bundles by security domain. The slider
follows a governed deployment sequence — it is not a maturity score, current
monetary attribution, or an investment recommendation. Simulate a target posture
to compare its portfolio effect.
Loading levers…
Hypothetical Target Posture Results
Gross Scenario Exposure
—
Residual Portfolio Exposure
—
Risk Reduction
—
MITRE ATT&CK Coverage
How well the active scenario model covers the ATT&CK Enterprise tactic framework, and which techniques are mitigated by in-place controls.
Tactic Coverage
Technique Mitigation
Load a workspace in Workshop first, then return here to see coverage data.