Beyond gut feel: data-driven cyber risk quantification

Cybersecurity risk assessment often struggles with subjectivity. Qualitative ratings like "High/Medium/Low" are common, making it difficult to consistently prioritise threats, objectively justify security investments, or clearly communicate risk posture in financial terms. While quantitative methods offer promise, they can rely on costly proprietary data or lack transparent connections to observed adversary behaviours.

This presentation introduces a practical, data-driven methodology for cyber risk quantification using open-source intelligence. We demonstrate how to systematically integrate the VERIS Community Database (VCDB), a rich repository of real-world breach details, with the MITRE ATT&CK framework, which catalogs adversary Tactics, Techniques, and Procedures (TTPs). The crucial link enabling this integration is provided by openly available mappings, which connect what happened in historic breaches (VERIS data) to how adversaries likely achieved their goals (specific ATT&CK TTPs).

While prior work analyses VCDB for trends or uses ATT&CK for control mapping, and frameworks like FAIR quantify risk often using expert estimates, the approach described in this work leverages the VCDB-ATT&CK mappings specifically to identify which attack techniques (TTPs) are most frequently associated with successful breaches within a target industry sector, based on historical data. This data-driven TTP relevance provides a more objective foundation for quantitative models compared to generic frequency estimates.

This TTP frequency analysis informs key risk components: estimating the likelihood of attacks involving relevant TTPs (Loss Event Frequency) and guiding impact assessment based on typical assets and data compromised (Loss Magnitude). Combining these allows for calculating Annualised Loss Expectancy (ALE) and measuring the value of security controls based on their effectiveness against the TTPs most pertinent to industry context of the organisation.

This methodology also provides a framework to potentially incorporate internal insights. While VCDB offers crucial industry context, data gathered from an organisation's own Security Operations Centre (SOC) - such as detected TTP attempts or blocked intrusions - can offer valuable ground truth. Comparing internal observations against the industry baseline derived from VCDB may allow for validating or cautiously refining the likelihood estimates, helping to tailor the risk picture to the organisation’s specific threat exposure and control performance.

This presentation provides a step-by-step guide using common tools, demonstrating how to query VCDB, apply mappings, identify key TTPs, consider internal data points, and perform quantitative risk calculations. Attendees will learn practical techniques to transform open and internal data into transparent, repeatable, and quantified risk insights. This empowers data-backed security investments, clearer communication in financial terms, and ultimately, moves cyber risk assessment beyond subjective gut feel.