An example of Quantitative Risk Analysis is estimating the likely financial loss from a phishing campaign by combining incident probability, expected downtime, response cost, and business impact. The result helps compare controls on a common monetary basis. Teams should document assumptions, use consistent inputs, and revisit estimates when threat or control conditions change.
How a quantitative risk example works in practice
A practical example is a phishing campaign model where you estimate the chance of successful compromise over a period, then translate the likely business effect into dollars. The value comes from combining frequency, downtime, response effort, fraud exposure, and productivity loss into one estimate that leaders can compare against other risks and controls.
The key is not precision to the nearest dollar, but a decision-grade estimate built from defensible inputs. That usually means separating event likelihood from loss magnitude, stating the time horizon, and making sure the same assumptions are used across competing control options.
What gets quantified, and why the assumptions matter
Quantitative Risk Analysis usually breaks a scenario into components that can be estimated, such as incident probability, direct response cost, outage cost, recovery work, legal or notification cost, and downstream business impact. In a phishing case, the model may also include the cost of account recovery, help desk load, and any expected loss from fraudulent transfers or interrupted operations.
Because the method depends on estimates, the assumptions are part of the analysis, not a side note. If the phishing scenario assumes one successful event per year but the control environment changes, the result should be updated. If downtime costs are based on a normal business day, the estimate should say so and not be reused blindly for a peak trading period or a critical launch window.
How teams use the result to choose controls
Once the loss estimate is expressed in monetary terms, teams can compare controls on the same scale. For example, stronger email filtering, phishing-resistant authentication, user training, and tighter payment approval workflows can each be assessed by whether their cost is lower than the loss they are expected to reduce.
That comparison is most useful when it supports a specific decision, such as whether to accept the residual risk, buy a control, or change a process. The analysis is less useful when it is treated as a one-time spreadsheet exercise with no owner, no review cycle, and no link to actual control performance.
Risk and Threat Considerations
Quantitative models can give a false sense of certainty if the inputs are stale, overly optimistic, or drawn from a different operating environment. Phishing loss estimates are especially sensitive to undercounted downtime, weak detection assumptions, and hidden follow-on costs such as incident response surge, customer support, or payment reversal work.
Failure mechanism: The estimate drifts when the probability inputs, loss assumptions, or control effectiveness numbers no longer match how the organisation actually operates, so the model understates exposure and misguides investment decisions.
Impact: A materially low estimate can lead teams to underfund controls, accept excessive residual risk, or delay remediation until a phishing event creates losses larger than the model predicted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Quantitative risk analysis directly supports risk strategy and financial prioritisation. |
| Recommendation — Use monetary loss estimates to prioritise controls and acceptances under a documented risk strategy. | ||
| CIS Controls v8 | CIS-5 — Account Management | Phishing loss scenarios often depend on account compromise and access control weakness. |
| Recommendation — Tighten account controls to reduce the likelihood and impact of phishing-driven compromise. | ||
| NIST SP 800-53 Rev 5 | RA-3 — Risk Assessment | The method is a risk assessment technique for estimating likelihood and impact. |
| Recommendation — Document scenario assumptions and update the assessment when conditions change. | ||
Practitioner Guidance
What to verify: Check that the scenario, time horizon, and loss components are explicit, and that the estimate distinguishes one-time incident cost from recurring business impact. If the model cannot explain how the dollar figure was built, it is not ready for a board or budget decision.
Decision rule: Use the estimate only when the same assumptions can be applied consistently across multiple control options. If one option reduces frequency and another reduces loss magnitude, compare both on the same basis before choosing.
What practitioners underestimate: Reputational damage, productivity loss, and follow-on response work often exceed the obvious incident costs. Those secondary effects should be named in the model, even if they are estimated conservatively.
Practitioner takeaway: The useful output of quantitative analysis is not a perfect forecast, it is a repeatable, assumption-aware financial estimate that lets risk owners compare controls and revisit the decision as conditions change.
Related resources from NHI Mgmt Group
- Guide: Cyber Risk Quantification Guide
- Why do non-human identities create more audit risk than human accounts?
- Why do non-human identities create audit risk in modern environments?
- Why do non-human identities create compliance risk even when policies exist?
- Why do collaboration tools create such a large secrets risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org