Score cyber threats with weighted matrix inputs. Compare inherent and residual risk across critical scenarios. Improve remediation planning using clear metrics, categories, and guidance.
Use 1 to 5 ratings. Increase weights for factors that matter most.
This calculator combines a classic matrix score with a weighted risk model. The matrix score helps visual prioritization. The weighted score adds cybersecurity context.
Scores are normalized to a 0–100 scale for easier comparison across risks, systems, audits, and remediation backlogs.
| Scenario | Likelihood | Impact | Criticality | Controls | Matrix | Inherent | Residual |
|---|---|---|---|---|---|---|---|
| Ransomware in file servers | 4 | 5 | 5 | 2 | 20 | 88.40 | 70.72 |
| Credential stuffing on portal | 5 | 4 | 4 | 3 | 20 | 82.00 | 49.20 |
| Misconfigured cloud storage | 3 | 5 | 5 | 2 | 15 | 80.60 | 64.48 |
| Single workstation malware | 2 | 2 | 2 | 4 | 4 | 40.00 | 16.00 |
The matrix score is the simple product of likelihood and impact. It highlights where a scenario falls on a 5×5 risk grid and supports fast visual prioritization.
Inherent risk shows exposure before considering controls. Residual risk shows what remains after accounting for current safeguards. Comparing both reveals whether controls actually reduce risk enough.
Use higher weights for factors your organization values most, such as compliance exposure or data sensitivity. Keep weights consistent across assessments if you want fair portfolio comparison.
Use 1 for the lowest condition and 5 for the highest. Define each level in your policy so analysts score threats consistently across teams and business units.
Yes. The compliance exposure factor and residual score help explain which risks could trigger legal, contractual, or regulatory attention and why they deserve stronger treatment.
Not always. Strong controls can reduce residual risk significantly. A scenario may look severe on the grid but become manageable after compensating safeguards are applied.
Reassess after major control changes, incidents, architecture updates, vendor changes, audit findings, or whenever the threat landscape or business impact assumptions shift.
The priority index blends residual risk with matrix severity. It helps rank remediation tasks when multiple cyber risks compete for limited engineering time and budget.
Important Note: All the Calculators listed in this site are for educational purpose only and we do not guarentee the accuracy of results. Please do consult with other sources as well.