Occurrence Exceedance Probability Curve

How the curve is used in cyber risk quantification

An Occurrence Exceedance Probability Curve turns cyber risk from a single-point estimate into a distribution view. It shows how likely different loss or impact thresholds are to be exceeded, which is useful when teams need to compare low-frequency, high-severity events with more common smaller losses.

In practice, the curve supports portfolio-style thinking: decision-makers can see the probability of crossing a given hazard level over a defined period rather than relying only on averages. That makes it easier to discuss appetite, tolerance, and capital or reserve expectations in financial terms.

What the curve actually represents

The x-axis is usually a severity or loss threshold, while the y-axis shows the probability that one or more events will exceed that threshold within the period being modelled. The curve is therefore about exceedance, not just event occurrence, and it helps separate frequency from magnitude.

That distinction matters because two environments can have similar expected loss while still presenting very different tail behaviour. One may produce many moderate events, while the other concentrates risk in a smaller number of severe outcomes.

Why exceedance curves matter for decision-making

Exceedance curves help organisations align security investments with business impact. They are especially useful when leaders need to understand whether controls are reducing the likelihood of medium losses, shrinking the tail of extreme losses, or both.

They also improve communication between technical teams and executives because the output can be read as a probability of surpassing a dollar loss, service disruption level, or other defined impact threshold. For teams using structured cyber risk quantification, NHIMG’s Cyber Risk Quantification Guide explains how loss exceedance curve fit into broader quantitative analysis.

Inputs, assumptions, and interpretation limits

The usefulness of the curve depends on the quality of the underlying frequency and severity assumptions. If event likelihoods, loss distributions, or scenario definitions are weak, the curve can look precise while still resting on uncertain inputs.

Interpretation also depends on model scope. A curve for one business unit, threat scenario, or control environment should not be treated as a universal statement about the entire organisation. Different scenarios can produce very different exceedance shapes, even when they share the same headline category of risk.

Risk and Threat Considerations

Exceedance curves can obscure as much as they reveal if the scenario set is incomplete, the loss model is poorly calibrated, or tail events are underrepresented. The main risk is not the chart itself but the false confidence that can arise when decision-makers treat a modelled probability as a stable forecast.

Failure mechanism: Weak inputs, omitted loss drivers, or poor scenario selection can flatten the tail, understate the probability of severe outcomes, and push investment decisions toward the wrong controls.

Impact: Organisations may underprepare for rare but expensive events, misjudge risk appetite, or allocate resources to problems that look larger in the model than they are in reality.

Practitioner Guidance

What to watch for: Use the curve as a decision aid, not a forecast guarantee. The most useful interpretation comes from comparing scenarios, stress-testing assumptions, and checking whether the curve changes in sensible ways when frequency, severity, or control assumptions are adjusted.

Governance implication: Keep ownership of the modelling assumptions explicit, because the curve is only as credible as the scenario definitions, calibration method, and review discipline behind it. For practitioners building or validating quantitative models, the FAIR Model and Open FAIR Standard Guide is a useful reference point for understanding how loss exceedance curves are derived and used.

Practitioner takeaway: Treat changes in the tail as the most decision-relevant signal, because small shifts in severe-loss probability often matter more than changes in average loss.

Related resources from NHI Mgmt Group

• How does a loss exceedance curve work?
• Why does a Loss Exceedance Curve matter for security teams?
• What is an example of Loss Exceedance Curve in practice?
• Loss Exceedance Curve