Risk Horizon
Notes on quantifying what most frameworks leave qualitative.
Practitioner analysis for risk, compliance, and security professionals: where published frameworks stop, and what quantification adds on top.
Threat Groups Share Suppliers. Scenario Models Assume They Do Not.
A takedown of shared offensive tooling shows that capability sits in the supply chain behind named groups, and that scenario models which simulate each group line independently understate the tail of the loss distribution.
Read the analysis →The Outbound Scenario: When Your Agent Is the Threat Community
Recent rogue agent incidents share a structure that standard risk registers cannot express, because the threat community is the organization's own agent and the asset belongs to someone else.
Read the analysis →The Patch Ticket Cannot See the Control Plane
When an active-exploitation warning names an authentication gateway or a build server, it moves both sides of the loss event frequency equation at once, and the patch ticket most programs file captures neither.
Read the analysis →Backups Are Not a Ceiling on Ransomware Loss
The most model-relevant finding in Mandiant M-Trends 2026 has no number attached, and it changes the shape of the ransomware loss magnitude distribution rather than a parameter in it.
Read the analysis →The Measurement Failure Inside Europe's Incident Reporting Regime
Europe's cyber information sharing problem is usually framed as a coordination failure, but the more expensive consequence is that mandatory incident data flows upward to supervisors and almost never returns as a rate.
Read the analysis →The Real Cost of an AI Security Line Is the Control It Replaces
AI security spend should be judged against the control it displaces, not against a fictional baseline where the same budget was doing nothing.
Read the analysis →The Number One Attack Vector Is Not Your Number One Attack Vector
A ranking from a credible corpus can sharpen cyber risk analysis, but only after it is converted from an ordinal headline into conditional rates with visible denominators.
Read the analysis →The Fine Is Not the Maximum
Regulatory penalties need to be modelled as contingent secondary loss, not carried as a statutory ceiling with a currency symbol.
Read the analysis →MITRE ATT&CK Coverage Has No Clock
A detection mapped to a technique is not resistance strength unless containment can finish before the attacker reaches the objective.
Read the analysis →Off Script Is Not the Same as Loss
The new AI agent incident pattern is being misread as risk level, when it is only the first term in a quantitative risk analysis.
Read the analysis →When Breach Statistics Lose Their Uncertainty
The DBIR's intervals are not presentation detail, they are the part a quantitative risk model should preserve.
Read the analysis →When the Register Tracks the Mean and the Tail Gets Repriced
Recent cyber insurance reporting points to a split that risk registers often hide: claim frequency can fall while claim severity rises. A register carrying one expected-loss figure per scenario can look more stable precisely when the tail exposure is becoming less tolerable.
Read the analysis →Show older analysis (8)
The Access Broker Is Not a Ransomware Footnote
Most risk registers treat credential theft as a precondition inside a ransomware scenario. A quantitative risk model gives a better answer: model the access broker as its own threat community, with its own frequency, capability, and control surface.
Read the analysis →Shadow AI Is Not a 670,000 Dollar Line Item
IBM's 2025 breach benchmark is useful, but not because it hands security leaders a neat shadow AI surcharge. The more actionable reading is that unmanaged AI tools reduce Resistance Strength across an expanding asset class before the loss event ever occurs.
Read the analysis →DORA Gives Risk Quantifiers a Decay Curve
DORA's fixed control cadences are not just compliance dates. In a quantitative risk model, they are regulatory evidence about how quickly Resistance Strength decays.
Read the analysis →Your Vendor List Is Not a Risk Assessment
Third-party involvement in breaches doubled in a single year. Most vendor-risk programs still produce an inventory and a questionnaire score, neither of which is a measure of loss.
Read the analysis →The Risk Register Line That Should Be a Range
Most risk registers carry a single expected-loss figure per scenario. That number is almost always wrong, and it hides the part of the risk that matters most.
Read the analysis →Dwell Time Is Falling. That Is Not the Same as Winning.
One detection metric hit a nine-year low in 2025. Two related measures moved the other way, and the gap that actually determines loss is widening.
Read the analysis →DORA Tells You to Classify the Incident. It Stops Before Telling You What It Cost.
The Digital Operational Resilience Act produces some of the most structured incident data a risk analyst could ask for, then declines to quantify any of it.
Read the analysis →DORA Third-Party Rules: A Governance Checklist, Not a Risk Number
The EU's Digital Operational Resilience Act tells financial entities exactly what to do about vendor risk. It does not tell them what that risk is worth, and that gap is where most third-party risk programs quietly stall.
Read the analysis →New Risk Horizon analysis added as frameworks and benchmark data warrant it, not on a fixed content calendar.
Continue the discussion
Risk Horizon is where these questions get worked through. For discussion of the ideas, connect on LinkedIn.
Connect on LinkedIn