Calculator Inputs
Use 1 (lowest) to 5 (highest) where applicable.
Formula Used
This calculator builds an impact score, then combines it with likelihood and exposure.
CIA = C·wC + I·wI + A·wA
C, I, A are 1–5. Weights auto-normalize to total 1.00.
Impact = CIA + adjustments
Adjustments add small lifts for regulatory, reputation, criticality, and value scaling. The final impact stays within 1–5.
- Weighted Multiplicative: Score = (Likelihood × Impact × Exposure) ÷ 125 × 100
- Risk Matrix: Score = (Likelihood × Impact) ÷ 25 × 100
Use multiplicative scoring when exposure varies meaningfully across scenarios.
How to Use This Calculator
- Name the scenario and enter approximate asset value.
- Set likelihood based on threat activity and ease of attack.
- Set exposure based on reachability and privilege pathways.
- Score CIA impacts using business and technical input.
- Adjust CIA weights only if your policy requires it.
- Click calculate, then export results as CSV or PDF.
Example Data Table
Sample scenarios to illustrate typical outputs.
| Scenario | Likelihood | Exposure | Impact | Score | Rating |
|---|---|---|---|---|---|
| Payment Portal | 4 | 4 | 4.10 | 52.48 | Elevated |
| Internal Wiki | 2 | 2 | 2.60 | 8.32 | Low |
| Public API Gateway | 5 | 5 | 4.40 | 88.00 | Critical |
Example values are illustrative and not a benchmark.
FAQs
1) What is inherent risk in security terms?
It is the expected risk level before considering existing controls. It focuses on the threat environment, exposure, and business impact for a scenario.
2) Why does this calculator include exposure separately?
Two systems can have similar likelihood and impact, but different reachability. Exposure captures internet access, privileged paths, and third‑party connectivity that increase attack opportunity.
3) Should I change CIA weights?
Only if your organization has a defined risk methodology. Otherwise, keep the defaults to maintain consistency across assessments and to simplify comparisons.
4) How do I interpret the 0–100 score?
Treat it as a normalized prioritization signal. Compare scenarios using the same method and scale. Use the rating labels to communicate urgency to stakeholders.
5) Does asset value dominate the impact?
No. Asset value is log-scaled and capped, so it gently influences impact. CIA and regulatory/reputation scores remain the primary drivers of the impact result.
6) What’s the difference between the two scoring methods?
Risk matrix uses likelihood and impact only, which is simpler. Weighted multiplicative adds exposure, giving more differentiation when attack surface varies across assets.
7) Can I use this for vendor or cloud risk reviews?
Yes. Use the scenario name to reflect the service, estimate exposure through access paths, and score impact based on data sensitivity and business dependency. Export results for review records.