From noise to numbers: Embedding cyber risk quantification into business decisions

Boards are tired of red, amber, green. Executives want to know what cyber risk actually means — not just how mature a control is, but how exposed the business is, and what it could cost. Yet many organisations still struggle to move beyond qualitative narratives when communicating cyber risk.

In this session, Karandeep Singh will walk through how organisations can embed Cyber Risk Quantification (CRQ) into their governance and decision-making. As the national lead for KPMG’s CRI (Cyber Risk Insights) capability, Karandeep will draw on real examples from banking, superannuation, & regulated sectors as well as other sectors like Retail, Energy and Infrastructure to show how CRQ is evolving from theory into practice.

This is not a vendor pitch or an academic talk. It’s a pragmatic look at what’s working, what’s not, and how to approach CRQ in a way that balances rigour with actionability.

Attendees will learn:

The session will also explore different quantification techniques, including scenario modelling, Monte Carlo simulations, and value-at-risk-style metrics. Karandeep will share lessons from embedding these into reporting frameworks, board updates, and investment prioritisation processes.

For cyber leaders seeking to elevate the way risk is understood at the top, this session will offer not just ideas — but implementable next steps.

This session focuses specifically on the implementation and delivery of cyber risk quantification methods. It complements, but is distinct from, our separate session on board-level reporting which explores how to communicate risk insights to executive and director audiences.