The useful answer

Start with the business service you cannot afford to lose. Describe a plausible failure, document uncertainty, and decide what evidence would change the response.

A score needs a story

A dashboard can show hundreds of vulnerabilities while leaving a leader unable to answer a basic question: which failure would hurt the business most? Counting findings is useful for managing work. Choosing what to fund requires a description of how a threat could interrupt a service, expose information, or create another material consequence.

Start with one important service rather than an attempt to price every cyber event. Ask its owner what has to keep working, which dependencies support it, and what changes when that service is unavailable. The answer may reveal a shared identity provider, a specialist supplier, or a manual approval that a server inventory misses.

Write a scenario that can be challenged

NIST IR 8286A Rev. 1 connects cybersecurity risk estimates to enterprise risk decisions through documented scenarios, likelihood, impact, and the organization’s risk appetite and tolerance. Treat an estimate as a structured judgment supported by evidence, not a precise prediction.

A useful working scenario might read: “A compromised administrator account prevents the order team from accessing its fulfillment system during a peak period.” That statement identifies a cause, a service, and a consequence. It can be discussed with the people who run the business. “Ransomware is high risk” gives them much less to examine.

Source: NIST IR 8286A Rev. 1: Identifying and Estimating Cybersecurity Risk →

Separate what you know from what you assume

Use evidence from your own environment wherever possible: access reviews, incident records, restore exercises, dependencies, and verified operating costs. Record when the evidence was collected and whether the system has changed since then. A recovery exercise from an earlier architecture may no longer support today’s estimate.

Document a range when evidence is uncertain. For a hypothetical fulfillment outage, the difference between a short disruption and a multiday interruption might depend on whether staff can use an alternate workflow. Test that dependency before presenting a single loss figure as settled. Avoid adding speculative losses together as though they were independent and certain.

Make the decision visible

A risk discussion should end with an accountable choice. The business owner may reduce exposure, redesign the process, arrange an alternative, or accept the remaining risk within the organization’s authority. A security team should not silently become the owner of every commercial tradeoff.

  • Scenario: What event are we preparing for, and which service is affected?
  • Evidence: What observation supports the likelihood and impact estimates?
  • Uncertainty: Which assumption could materially change the decision?
  • Response: What control or operational change addresses the scenario?
  • Owner and review: Who accepts the remaining risk, and when is it reconsidered?

Measure the next improvement

NIST’s current incident-response guidance places preparation, response, and recovery within ongoing risk management. Use an exercise or a narrowly scoped improvement to learn something concrete about your scenario.

For example, test whether a backup can restore the business workflow when normal identity services are unavailable. Record the result, the missing dependency, and the decision it changes. A smaller uncertainty that leads to a better investment is more valuable than a more elaborate score with no effect on priorities.

Source: NIST SP 800-61 Rev. 3: Incident Response Recommendations →

Related speaking resource

For an event or leadership discussion on this topic, explore the incident response speaking resource.

Common questions

Is a vulnerability score the same as business risk?

No. A technical severity score is one input. Business risk also depends on exposure, controls, dependencies, likelihood, consequences, and the organization’s tolerance.

Should every cyber risk have a dollar value?

Use the form of analysis that supports the decision and the available evidence. Where financial ranges help, document assumptions and uncertainty instead of implying unsupported precision.

Sources & edition note

This refreshed edition retains the original article title and path. It replaces the earlier commentary with an updated discussion; historical predictions and unsupported numerical claims have not been carried forward.

Examples and decision checklists are editorial guidance, not reports of measured client results. Sources reviewed November 4, 2026.