How the Risk Score Is Built

The score multiplies three ordinal ratings, each on a one-to-five scale. Threat captures the capability and motivation of the adversary or hazard. Likelihood captures how probable successful exploitation is within the assessment period. Impact captures the severity of the consequence if it succeeds. Their product ranges from 1 to 125. Multiplication is used rather than addition on purpose: if any single factor is near zero — no credible threat actor, or negligible consequence — the whole risk collapses, which is the behaviour a risk register should exhibit.

Inherent Versus Residual Risk

Inherent risk is exposure before any credit for controls. Residual risk is what survives once control effectiveness and detection capability are applied. Governance frameworks including ISO 27005 and NIST SP 800-30 expect both to be recorded, and for good reason: a residual score of 12 that depends entirely on a single control is a materially different proposition from an inherent score of 12 that needs no control at all. Recording only the residual figure hides that dependency, and it is precisely the dependency that fails during an incident.

Why Detection Capability Is Separate

Preventive controls reduce the chance an incident happens. Detection determines how long it runs before anyone notices. Two organisations with identical prevention will suffer very different losses if one detects intrusion within hours and the other within months, because dwell time drives lateral movement, data staging and exfiltration volume. This calculator therefore applies a multiplier that runs from 1.00 at the strongest detection rating to 1.20 at the weakest, inflating residual exposure wherever visibility is poor.

Adding a Monetary View

Ordinal scores rank risks but do not price them, which makes control investment hard to argue. The advanced section adds the classic quantitative chain: single loss expectancy is asset value multiplied by exposure factor, the proportion of value destroyed in one occurrence; annual loss expectancy is that figure multiplied by the annual rate of occurrence. An annual loss expectancy of $87,500 tells you immediately whether a $30,000 control is worth buying, in a way that a score of 48 out of 125 never will.

Treating the Result

On the 125-point scale, 1 to 15 is Low, 16 to 40 Medium, 41 to 75 High and above 75 Critical. Low risks are normally accepted with periodic monitoring. Medium risks are mitigated or transferred through insurance or contractual terms. High risks require additional controls against a defined remediation date. Critical risks escalate to an executive owner and frequently trigger avoidance — discontinuing the activity. Be aware of the method's main limitation: ordinal ratings are not true numbers, so products of them can order risks in ways a fully quantitative approach such as FAIR would not. Treat this calculator as triage that identifies which risks deserve deeper quantitative analysis, not as the final word on any of them.