Why traditional cyber risk assessment in cybersecurity is broken

Most cyber risk heatmaps look tidy. Luke Irwin argues that is part of the problem.

Luke Irwin, Aegis Cybersecurity

In the first of a two-part series, republished here with the Aegis Cybersecurity founder's permission, he claims traditional 5x5 risk matrices can give boards a false sense of clarity, while doing little to answer the harder question: where should the next dollar of cyber budget actually go?

Anyone who has known me for a while will know this is not a new view. I have been consistently critical of the way many organisations assess cyber risk through traditional 5x5 risk matrices, and the more I work with boards, executives, and operational teams, the more convinced I become that this approach is not just limited, but fundamentally unhelpful for the kind of decisions leaders are actually trying to make.

That is not to say risk management itself is the problem. It is not. The problem is that many organisations are still trying to force cybersecurity into frameworks and methods that were built for different categories of risk. Those methods may work reasonably well for some operational, safety, environmental, or compliance issues, but cybersecurity does not behave in quite the same way. It moves faster, it changes more often, and it is shaped by intelligent human adversaries who adapt their behaviour in response to the controls you put in place.

That matters more than many people realise.

When an organisation assesses the risk of fire, flood, equipment failure, or physical injury, it is generally looking at events that are not consciously trying to outmanoeuvre the control environment. Cybersecurity is different. Attacks are initiated. They are deliberate. They are targeted, opportunistic, automated, persistent, or some combination of all four. That means the way likelihood is considered in many traditional risk models does not translate neatly into the cyber context.

And that is where the standard matrix starts to fall apart.

Most enterprise risk matrices rely on broad planning horizons. Next quarter. Next year. The next three years. The next five years. That may be perfectly serviceable in a general enterprise risk context, but cyber risk rarely sits still long enough to be comfortably viewed through those lenses alone. In cybersecurity, the timeline that matters is often much shorter and much sharper. Today matters. This week matters. This month matters. Sometimes the difference between a manageable event and a serious incident is not the next budget cycle, but whether the right decision was made within a matter of hours.

Trying to compress that kind of risk into a coloured square on a heatmap often produces something that looks neat, board-friendly, and reassuringly familiar, but tells you very little of practical value, and is not much more than security theatre.

That becomes obvious the moment you ask a room full of security professionals to assess the same risk. It is not uncommon to see a spread of views, not because the people in the room are incapable, but because qualitative scoring leaves a great deal open to interpretation. One person is weighting industry threat activity more heavily. Another is thinking about the maturity of the internal environment. Another is focusing on recoverability. Someone else is thinking about regulatory or reputational consequences. The matrix suggests precision, but what it often delivers is structured subjectivity.

The next issue is prioritisation, and this is where the practical weakness of the model really starts to show.

If you have five cyber risks sitting in the top right-hand corner of a 5x5 matrix, all rated as highly likely and critical impact, what exactly have you learned? You know they are all bad. Fine. You probably knew that before the workshop started. What you do not know is which one is worse in financial terms, which one is more probable in the period that matters, which one is most effectively reduced through available controls, and which one deserves the next dollar of budget. If everything serious ends up in the same part of the grid, the matrix may be giving you categorisation, but it is not really giving you prioritisation.

That distinction matters because organisations do not have unlimited money, unlimited people, or unlimited time. Leaders are constantly making trade-offs. They are deciding what gets funded now, what gets deferred, what gets accepted, and what gets transferred through insurance or contractual mechanisms. A model that tells you several things are all equally red is not giving you enough to make those trade-offs well.

It gets more complicated again when you start looking at controls.

One of the recurring weaknesses in traditional cyber risk scoring is that it rarely reflects the reality that different controls affect risk in different ways. Multi-factor authentication may materially reduce the likelihood of certain forms of compromise, particularly identity-driven attacks, but it does not necessarily reduce the consequence of every incident that could still occur. Encryption can reduce the severity of harm in some data exposure scenarios, but it does not stop somebody attempting the attack in the first place. Monitoring and detection may not reduce the chance of initial compromise at all, but they can reduce dwell time, contain spread, and limit downstream loss. Good backups may do little to prevent a ransomware event from starting, but they can make an enormous difference to the cost and duration of recovery.

These distinctions are not academic. They are exactly the kinds of distinctions boards and executives should care about, because they go directly to the question of what a given investment is actually buying the organisation. Unfortunately, once those nuances are forced back into a basic before-and-after risk score, much of that value disappears into simplification.

And that is the deeper problem.

The 5x5 model creates the appearance of discipline without necessarily improving the quality of the decision. It gives organisations a process. It gives them a chart. It gives them a workshop output. It gives them a board slide. What it does not reliably give them is a defensible answer to the questions that matter most.

• What is this actually likely to cost us?
• How likely is it really?
• What will make the biggest difference?
• Where should we spend next?
• What can we safely defer?
• What causes the least harm if budget gets cut?

Those are business questions. They require more than a colour.

That is why I remain so critical of the 5x5 approach in cyber. It gives many organisations the impression that they are measuring risk well, when in reality they are often just labelling uncertainty in a more colourful way. It is familiar, simple to facilitate, easy to present, and rarely challenges anyone too hard. In many cases, it supports governance theatre more than it supports meaningful prioritisation.

That may be good enough for some categories of enterprise risk. It is not good enough for cybersecurity.

Cybersecurity is dynamic, adversarial, and increasingly expensive. It is shaped by intent, capability, targeting, exposure, control maturity, response speed, and recovery capability. It changes quickly, sometimes violently, and often in ways that do not align with the comfortable cadence of annual risk reviews and broad qualitative scoring.

So when I say traditional cyber risk assessment is broken, this is what I mean.

I do not mean risk should not be assessed. It absolutely should. I mean that many organisations are still using a model that was not designed for the pace, behaviour, and economics of cyber threat, and then acting surprised when the outputs are vague, inconsistent, and difficult to use for real investment decisions.

If all your major cyber risks are rated high, but you still cannot explain which one matters most, what each is likely to cost, or what control will most efficiently reduce the exposure, then you do not really have a prioritisation model.

What you have a pretty wall poster, that is about as good for maintaining the structural integrity of the building as it is for assessing the actual risk.

It is time to do better.

Luke Irwin is the founder and principal consultant at Brisbane-based Aegis Cybersecurity, providing advisory services focused on fractional and virtual CISO engagements, governance, risk and compliance and operational resilience. He has more than two decades of experience in information technology, covering ICT operations management and cyber security.

Disclaimer: The views expressed in this Q&A are those of the individual contributors and do not necessarily reflect the views of iTnews or techpartner.news. The content is provided for general informational purposes only and does not constitute legal, financial or professional advice.