Unlocking Cyber Risk: 4 Key Steps to Success

Is your cyber risk quantification (CRQ) fit for purpose? In PwC’s Global Digital Trust Insights 2025Opens in a new window survey, only 15% of organisations are measuring cyber risk to a significant extent. How then can you set up your CRQ to deliver the critical insights your business needs? As explored here, our four-step approach can offer a practical and strategically aligned way forward.

Your board needs credible, intelligible and actionable cyber risk reporting insights to assess the threats your business faces and judge how best to respond. If your CRQ and reporting activities aren’t delivering, you could end up directing investment at the wrong targets, while still leaving your business needlessly exposed.

Dispelling myths

The problem is that CRQ effectiveness is often undermined by the myths and misplaced confidence that have built up around it. Chief among these misconceptions is that CRQ can be pulled off the shelf and immediately put to work. 

In reality, CRQ can never be a straightforward ‘plug-and-play’ solution. Too often, it becomes a point-in-time exercise focused on generating numbers rather than delivering real insights. When CRQ is treated as a box-ticking exercise, it risks providing quantification for the sake of it, without supporting smarter decision-making, improving board-level communication, or strengthening engagement with regulators. To be truly effective, CRQ must go beyond the numbers, helping businesses navigate trade-offs between security, compliance and innovation, while promising its outputs drive real value.

 Cyber risks are inherently complex and constantly evolving — that won’t change. But CRQ shouldn’t exist in a vacuum, disconnected from the people who rely on it. For CRQ to be effective, it must provide actionable insights that inform strategic decisions, improve board-level governance and strengthen regulatory engagement. This means translating complex, technical data into meaningful narratives that resonate with stakeholders. It’s not just about generating numbers — it’s about delivering clarity, enabling better decisions, and ensuring risk quantification drives real business value. 

 It’s important to build your CRQ around your business goals — making it relevant and relatable within your organisation and anchoring your capabilities in credible data practices. These are the key priorities underpinning our four-step approach. 

Step 1 Define the key strategic questions CRQ needs to address 

The starting point is setting clear objectives and parameters for CRQ by defining the questions that the reporting needs to answer. Likely considerations include: 

What’s the potential impact of the cyber risks we face — strategic and reputational, as well as financial losses?

Are our cyber risks and ability to withstand them within acceptable limits?

What’s the return on investment (RoI) from our risk protection and mitigation measures?

How can dynamic simulations of security changes improve decisions by showing their impact on cyber risk reduction?

 This top-down focus would help to sharpen strategic clarity and prioritisation by ensuring that CRQ data, modelling and use of the model outputs hone in on the critical risks and decisions facing your organisation. A key benefit is avoiding what can often be a poorly focused bottom-up approach to CRQ, which starts from the data and the risk quantification model and then tries to answer the questions with what’s been modelled.

Step 2 Automate and optimise data 

Effective CRQ relies on reliable, comprehensive and actionable data. Yet, quality and consistency are often impeded by siloed data pools and poorly organised repositories.

The first priority is establishing a robust risk taxonomy that creates clear relationships between risks, threats and controls in a scalable and manageable way. There are several industry best practice standards covering different parts of the end-to-end risk taxonomy (e.g., the NIST Cybersecurity Framework, MITRE ATT&CK Framework, and the FAIR risk quantification methodology). However, there isn’t enough information in the public domain on how these frameworks feed into each other and how they align with your organisation’s specific enterprise risk taxonomy. These interrelations are critical for comprehensive risk modelling. 

 Data automation and optimisation often requires input from a range of internal teams, augmented by third-party expertise when the necessary skills are unavailable in-house. Crucially, these relationships must remain dynamic and adapt to emerging threats. Only then can you unlock the full value of a data-driven risk model. 

 The quality of this taxonomy is vital to the entire risk measurement and reporting process. It underpins the accuracy and utility of CRQ, ensuring that decision-makers are equipped with the insights needed to respond effectively to evolving cyber risks. It’s important to regularly update this data model to reflect changes in threats and business contexts — a process that can help to avoid what’s known as ‘algorithmic inertia’¹. A combination of automated processes and expert sense-checking can help to make sure that data and models remain relevant and reliable over time.

 Once the taxonomy is established, automating and optimising data collection will help address data quality challenges. The use of ‘security posture management’² tools can provide continuous monitoring of the rapidly changing threat landscape, enabling organisations to stay ahead of potential risks. 

 Generative artificial intelligence (GenAI) has a key role to play here. Its ability to summarise and interrogate data can enrich human insight. For example, GenAI can curate and summarise vast amounts of threat intelligence relevant to your organisation or answer questions regarding your risk posture, without you needing to interpret data in reports. 

44%

of business leaders cited data issues as the main challenge to effective cyber risk quantification.

PwC 2025 Global Digital Trust Insights 

Step 3 Bring together the ‘best of both worlds’ — qualitative and quantitative analysis 

Combining the narrative of qualitative insights with the precision of quantitative analysis can strengthen the basis for decision-making by making the analysis more intelligible, strategically relatable and action-orientated. 

 To embed dynamic and trusted risk management, organisations are increasingly blending automation with human insights and driving behavioural change. 

Automation delivers richer, up-to-date telemetry that gauges the effectiveness of cyber defences and enables rapid, targeted actions to mitigate evolving cyber threats.

For example, a CISO wants to know if controls are effective today and whether they have degraded over the last week or month using live metrics. This provides real-time visibility.

Additionally, when a material new threat emerges, CISOs ideally want to take immediate action to mitigate it before being questioned by the executive committee or board—who may have read about it in the press. This builds confidence in the organisation’s risk posture.

While automation enhances speed and precision, it isn’t enough on its own. Human experience and expertise remain crucial in interpreting the broader operational and strategic context that informs risk decisions.

For instance, there may be known gaps in controls that automated metrics don’t highlight. These gaps often stem from strategic business activities such as product launches, outsourcing or M&A, which introduce new variables to the technology and supplier ecosystem.

Furthermore, as threats evolve, so must controls. For example, the shift in threats targeting cloud identities has driven advancements in strong authentication controls. These insights depend on human expertise to interpret and adapt.

Effective risk management also requires the right organisational culture. Think of culture as what people do when no one is watching. The focus should be on fostering behaviours that encourage open communication across all levels and harmonious collaboration between functions and lines of defence.

In some organisations, adversarial relationships between security, IT and risk functions create challenges, especially under pressure, such as during regulatory examinations. This antagonism can devolve into unproductive conflict.

By contrast, organisations fostering collaboration and openness share real-time access to risk and control telemetry. This transparency allows different functions to derive insights for their specific needs. Risk measures risk, security assesses threat exposure, and IT prioritises and tracks remediation actions. This collective approach promotes problem-solving and strengthens trust.

 By integrating qualitative and quantitative analysis, leveraging automation and human expertise, and fostering a collaborative culture, organisations can achieve a more holistic and actionable approach to cyber risk management. 

Step 4 Turn complex data into actionable communications

Clear, actionable, and compelling communications are the ultimate test of value for cyber risk reporting by answering strategic cyber questions in a way that helps your Board to understand the implications and weigh their response. As part of this process, what-if modelling should help to create and present options for different actions. This approach allows the board to evaluate scenarios, compare potential outcomes, and make optimal decisions based on the relative merits of each option. 

 Priorities include conveying the key messages in a business language your audience understands and making a clear connection between cyber risk and strategic goals.

 Visualisation tools can help to enhance engagement and insight by turning complex data into interactive dashboards that can be tailored to different audiences. For board members, the data and messaging should focus on the business impact and whether threats, vulnerabilities and safeguards align with your risk appetite. For operational teams, reports might drill deeper into technical details and recommended actions. 

 By translating complex data into actionable, option-based insights through approaches like what-if modelling and audience-specific communication, organisations can bridge the gap between technical analysis and strategic decision-making. 

Conclusion

CRQ is no longer optional — it’s a strategic imperative in an era where the stakes of cyber threats are higher than ever. However, achieving its full potential requires moving beyond common misconceptions and superficial implementation and towards a tailored, strategic approach. 

 PwC's four-step framework provides a roadmap for businesses to align their CRQ capabilities with their strategic goals. By defining critical strategic questions, automating and optimising data, integrating qualitative and quantitative analysis, and translating complex insights into actionable communications, organisations can transform CRQ into a powerful tool for smarter decision-making. 

 Immediate key considerations for impactful CRQ include: 

Knowing your audience and the questions you need to answer: Tailor your analysis and communication to address the specific concerns and priorities of different stakeholders, whether they’re board members, operational teams, or external regulators.

Consistency and baselining: Establish a baseline for measurement and deliver a consistent approach to analysis. This helps track progress and measure changes effectively over time.

Repeatability with flexibility: Develop a repeatable approach that remains dynamic enough to adapt to different scenarios and provides tailored analysis for various audiences.

Connecting the dots across the enterprise: Integrate data from posture management tools, exception tracking, and issue reporting to create a comprehensive view of the organisation’s risk posture and align it with enterprise-wide objectives.

 Effective CRQ fosters improved understanding, collaboration and informed decision-making across your organisation. It positions CISOs and their teams as enablers rather than impediments to digital transformation and innovation. The resulting value gains include enhanced ROI on cybersecurity investments, bolstered resilience, and strengthened trust among customers and regulators. 

 The journey to effective CRQ is neither instant nor easy, but it’s essential. With the right strategy and commitment, organisations can unlock the full value of CRQ and build a safer, more resilient digital future. 

1 “Algorithmic inertia” is defined as “when organizations use algorithmic models to take environmental changes into account but fail to keep pace with those changes.” Source: MIT Sloan research feature, Predictive Models Can Lose the Plot. Here’s How to Keep Them on Track, June 2023, https://sloanreview.mit.edu/article/predictive-models-can-lose-the-plot-heres-how-to-keep-them-on-track/ Opens in a new window

2 “Security posture” is defined as “The security status of an enterprise’s networks, information, and systems based on information assurance resources (e.g., people, hardware, software, policies) and capabilities in place to manage the defense of the enterprise and to react as the situation changes.” Sources: NIST SP 800-30 Rev. 1 under Security Posture from CNSSI 4009" 