Financial Risk

A board does not act on "critical vulnerability". It acts on a number in currency. This module exists to change the language of the conversation, not to add another dashboard.

What it measures

Your estimated annual financial exposure: what today's open problems could cost you over a year. It measures nothing on its own — it is fed by what Vendor Risk, Email Authentication, Compliance Posture, Alert Center, and Attack Surface have already found.

The total breaks down into five scenarios:

• Data breach
• Ransomware
• Business email compromise (BEC) — the most underestimated one, and the one that looks most like an ordinary workday.
• Regulatory fine
• Business interruption

How to set it up

1. 1

   Complete the financial profile

   Industry, annual revenue bracket, and employee bracket. No calculation is possible without it: those three data points place your company against the benchmarks. It is entered once and can be edited later; only an organization administrator can do it.

2. 2

   Let the calculation run

   It recalculates automatically every week. If you have just closed a significant finding and want to see the effect, *Recalculate now* forces it.

3. 3

   Have data in the other modules

   The result is worth exactly what its inputs are worth. With one module populated, the figure is a silhouette; with five, it starts being an estimate.

How to read the result

At the top, the estimated annual exposure with the calculation date. Below it, the breakdown by scenario and the historical trend.

The trend matters more than the absolute number. The point figure carries all of the model's uncertainty; the direction — whether it falls month over month — reflects real work and is far less sensitive to how precise the benchmarks are.

The remediation opportunities section is the most actionable part of the module: it takes the open findings from the other modules and ranks them by how much your exposure drops if you fix each one, with the estimated effort beside it. It is a work list prioritized by money rather than by technical severity — and the two do not always agree.

What to do with the result

• Work the remediation list top down. It is ordered by savings; crossing it with the effort column gives you what is worth doing this week.
• Generate the board report before the meeting. It carries the exposure, the breakdown, the trend, the top opportunities, and an executive summary written in business language, exportable to PDF.
• Present the assumption along with the number. A board that understands where the figure comes from uses it to decide; one that receives a number without context argues about it instead of acting.
• Recalculate after closing something significant and keep that before-and-after: it is the cleanest way to justify next year's budget.