exposure-risk-quantification

name	exposure-risk-quantification
description	FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownership-aware factors: exposure/threat/impact), an ownership + proof demotion cap so unproven or weakly-owned findings can't inflate the number, a $-denominated FAIR loss-magnitude estimate (IBM/Ponemon per-record cost bands, cross-source record dedup, threat-factor annualization), attack-path amplification (curated red-team chain catalog + generic graph-walk engine, with a kill-chain vs shared-fate honesty gate), and a board-ready one-pager deliverable (hero $ + letter grade + top-3 findings + top attack path + the ask). Extends osint-methodology's severity rubric and client deliverable templates with quantification. Passive analysis only -- operates on findings already collected, no target traffic, no API keys. Use when asked to score risk, quantify exposure, estimate breach cost, build a board report, translate technical findings to dollars, or explain why a grade or dollar figure came out the way it did.
version	1
sources	asm_reference_impl, ibm_ponemon, public_research
triggers	["risk score","risk quantification","cyber risk quantification","CRQ","FAIR methodology","FAIR score","loss event frequency","loss magnitude","risk grade","letter grade risk","A-F grade","0-100 risk score","board report","board deliverable","board ready","executive summary risk","CISO report","hero number","dollar exposure","breach cost estimate","loss estimate","annualized loss expectancy","ALE","per-record cost","IBM Ponemon","cost of a data breach","exposed record count","quantify risk","risk translation","attack path","kill chain","shared fate exposure","[Truncated]"]

Exposure Risk Quantification — FAIR Scoring, $-Loss, and the Board Deliverable

Companion skill: osint-methodology (the "how to think" recon skill — see its §9 severity rubric and §16 client deliverable templates). This skill is the "how to quantify and present" layer on top of a finished recon pass: it takes findings the methodology skill's pipeline already produced and turns them into a number a board will act on.

0. When to Use / When NOT

Use this skill when: you have a completed set of recon findings (from any engagement, not just one tool's output) and need to (a) compute a defensible 0–100 + A–F risk score, (b) estimate a $-denominated loss range, (c) rank attack-path chains by exploitability, or (d) assemble a board/exec one-pager. Also use it to explain a score — "why did this grade come out D and not F" is exactly what §7 is for.

Do NOT use this skill when: you still need to go collect findings — that's osint-methodology (methodology) / offensive-osint (arsenal). This skill does not probe anything; it has nothing to say until a recon pass has already produced findings, assets, and (ideally) ownership/proof annotations.

---

1. Posture: Passive Analysis, Not New Recon

Every computation in this skill is a pure function over findings + assets you already hold — no network calls, no new probes, no target traffic. The reference implementation (reporting/{risk_score,loss_model,board_report,board_render,attack_paths, attack_graph,owner_confidence,proof}.py) is explicit about this: risk_score.py docstring calls itself "Pure compute over scan.db — no network, no schema change"; loss_model.py calls itself "Pure, no network"; attack_graph.py calls itself "Pure + offline."

That means this skill inherits the authorization posture of whatever collected the inputs (see osint-methodology §1) but adds none of its own — quantifying findings you already lawfully hold is never itself an intrusive act. It also means the outputs are only as good as the inputs: garbage findings (unowned namesakes, unverified snippet matches) produce a garbage score unless you apply the demotion cap in §7.5 first.

---

2. Confidence Levels

Reuses osint-methodology §2 verbatim — every finding you're about to score already carries one of:

Level	Meaning
TENTATIVE	Plausible, unverified.