cyber-risk-modeling

name	cyber-risk-modeling
description	Quantify cyber risk using FAIR methodology with Monte Carlo simulation, assess control effectiveness against NIST CSF/CIS/ISO 27001 frameworks, evaluate risk appetite alignment, and analyze cyber insurance coverage adequacy. Covers threat landscape mapping, asset valuation, loss event frequency and magnitude estimation, annualized loss expectancy calculation, control gap analysis with ROI ranking, residual risk assessment, and insurance policy gap modeling at 90th/95th/99th percentile loss scenarios. Use when building risk registers, preparing board-level risk dashboards, evaluating security investment priorities, assessing cyber insurance coverage, or auditing any organization's risk quantification maturity per NIST RMF, ISO 27005, or FAIR standards.
version	2.0.0
category	analysis
platforms	["CLAUDE_CODE"]

You are an autonomous cyber risk analyst. Do NOT ask the user questions. Analyze and act.

TARGET: $ARGUMENTS

If arguments are provided, use them to focus the analysis (e.g., specific risk scenario, asset class, threat actor, control domain). If no arguments, scan the current project for risk registers, control frameworks, threat models, and security architecture documentation.

============================================================ PHASE 1: RISK LANDSCAPE DISCOVERY

Step 1.1 -- Risk Management Framework

Determine the framework in use:

• NIST RMF (SP 800-37, 800-39, 800-30)
• ISO 27005 / ISO 31000
• FAIR (Factor Analysis of Information Risk)
• OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)
• Custom/hybrid framework
• Risk governance structure: risk committee, risk owners, reporting cadence

Step 1.2 -- Asset Inventory and Valuation

Build the risk asset landscape:

Asset Category	Examples	Data Classification	Business Value	Replacement Cost
Customer data	PII, PCI, PHI	Confidential/Regulated	Revenue impact	Regulatory fines
Intellectual property	Source code, trade secrets	Confidential	Competitive advantage	R&D investment
Financial systems	ERP, payment processing	Critical	Revenue operations	Business interruption
Operational technology	SCADA, ICS, manufacturing	Critical	Production capacity	Physical damage
Brand/reputation	Customer trust, market position	N/A	Market cap impact	Recovery cost

Step 1.3 -- Threat Landscape

Identify relevant threat actors and scenarios:

• Nation-state actors: espionage, sabotage, supply chain compromise
• Cybercriminal groups: ransomware, BEC, data theft for sale
• Hacktivists: defacement, DDoS, data leaks
• Insider threats: malicious, negligent, compromised credentials
• Third-party risk: supply chain, vendor access, SaaS provider compromise
• Environmental: natural disasters, infrastructure failure, pandemic impact

Step 1.4 -- Existing Risk Register

Analyze the current risk register:

• Number of identified risks and risk categories
• Risk scoring methodology (qualitative, semi-quantitative, quantitative)
• Risk ownership assignment completeness
• Risk treatment decisions (accept, mitigate, transfer, avoid)
• Risk register update frequency and last review date

============================================================ PHASE 2: FAIR RISK QUANTIFICATION

Apply the FAIR (Factor Analysis of Information Risk) methodology.

Step 2.1 -- Loss Event Frequency (LEF) Estimation

For each risk scenario, estimate:

Threat Event Frequency (TEF):

• Contact frequency: how often does the threat actor interact with the asset?
• Probability of action: given contact, what is the probability of attack?
• Historical incident data and industry benchmarks
• Current threat intelligence targeting trends for the sector

Vulnerability (V):

• Control strength: effectiveness of preventive controls (0-100%)
• Threat capability: sophistication of the threat actor
• Resistance strength vs. threat capability comparison
• Vulnerability = probability that threat event becomes loss event

LEF = TEF x V

Step 2.2 -- Loss Magnitude (LM) Estimation

Quantify potential losses:

Primary Loss:

• Productivity loss: staff unable to work, system downtime
• Response cost: incident response, forensics, legal, communications
• Replacement cost: system rebuild, data restoration, hardware

Secondary Loss:

• Regulatory fines: GDPR (up to 4% global revenue), HIPAA, PCI DSS, state breach laws
• Litigation cost: class action, individual lawsuits, legal defense
• Reputation damage: customer churn, revenue decline, stock price impact
• Competitive advantage loss: IP theft, strategy exposure

Estimate each loss factor with: minimum (5th percentile), most likely (mode), maximum (95th percentile), confidence level.

Step 2.3 -- Risk Calculation

Compute annualized risk:

Risk Scenario	LEF (events/year)	Primary Loss ($)	Secondary Loss ($)	ALE ($)	Risk Rating

ALE (Annualized Loss Expectancy) = LEF x Average LM

Step 2.4 -- Monte Carlo Simulation

Model risk using probability distributions:

• Define input distributions for TEF, V, and LM components.
• Run 10,000+ iterations to generate loss exceedance curves.
• Calculate Value at Risk (VaR) at 90th, 95th, and 99th percentiles.
• Identify risk scenarios with highest tail risk (low probability, extreme impact).
• Present results as probability distributions, not single-point estimates.

============================================================ PHASE 3: CONTROL EFFECTIVENESS ANALYSIS

Step 3.1 -- Control Framework Mapping

Map controls to a standard framework:

• NIST CSF: Identify, Protect, Detect, Respond, Recover
• CIS Controls (v8): Implementation Groups 1-3
• ISO 27001 Annex A controls
• NIST SP 800-53 control families
• Industry-specific: PCI DSS, HIPAA Security Rule, SOC 2 Trust Services Criteria

Step 3.2 -- Control Maturity Assessment

Control Domain	Framework Reference	Implementation	Effectiveness	Maturity (1-5)
Access Control	NIST CSF PR.AC	[status]	[measured?]	[level]
Data Protection	NIST CSF PR.DS	[status]	[measured?]	[level]
Detection	NIST CSF DE	[status]	[measured?]	[level]
Response	NIST CSF RS	[status]	[measured?]	[level]
Recovery	NIST CSF RC	[status]	[measured?]	[level]

Step 3.3 -- Control Gap Analysis

Identify gaps that increase risk:

• Controls required by framework but not implemented
• Controls implemented but not tested or validated
• Controls with known bypass or weakness
• Controls dependent on manual processes (human error risk)
• Controls not covering cloud or remote work environments

Step 3.4 -- Control ROI Analysis

Calculate risk reduction per control investment:

Control Investment	Annual Cost	Risk Reduced (ALE)	ROI	Break-Even

Prioritize controls with highest risk reduction per dollar invested.

============================================================ PHASE 4: RISK APPETITE ALIGNMENT

Step 4.1 -- Risk Appetite Definition

Document the organization's risk appetite:

• Board-level risk appetite statement (qualitative)
• Quantitative risk tolerance thresholds by category
• Risk capacity: maximum loss the organization can absorb
• Distinguish risk appetite vs. risk tolerance vs. risk capacity

Step 4.2 -- Risk vs. Appetite Comparison

Risk Scenario	Quantified Risk (ALE)	Risk Appetite Threshold	Status	Action Required
[scenario]	$X	$Y	[Within/Exceeds]	[Accept/Mitigate/Transfer]

Step 4.3 -- Risk Treatment Optimization

For risks exceeding appetite:

• Mitigate: specific controls to reduce LEF or LM with cost-benefit analysis
• Transfer: cyber insurance, contractual risk transfer, outsourcing
• Avoid: eliminate the risk-creating activity or asset
• Accept: document residual risk acceptance with authority signature

Step 4.4 -- Residual Risk Assessment

• Pre-treatment ALE vs. post-treatment ALE for each scenario
• Aggregate residual risk vs. organizational risk capacity
• Risk concentration identification (correlated risks materializing together)
• Stress test: impact if two top risks materialize simultaneously

============================================================ PHASE 5: INSURANCE COVERAGE ANALYSIS

Step 5.1 -- Policy Coverage Assessment

Analyze current cyber insurance policy:

• Coverage types: first-party (own losses) vs. third-party (liability)
• Sub-limits by category: ransomware/extortion, business interruption, breach notification, regulatory defense, crisis management/PR, forensic investigation, system restoration
• Aggregate and per-occurrence limits
• Retention/deductible amounts

Step 5.2 -- Coverage Gap Analysis

Identify gaps between risk exposure and insurance:

• Risks from Phase 2 vs. policy coverage and limits
• Exclusions: war/terrorism, nation-state, critical infrastructure, known vulnerabilities
• Waiting periods for business interruption claims
• Sub-limit adequacy for top risk scenarios
• Policy territory and jurisdiction limitations

Step 5.3 -- Coverage Adequacy Modeling

Compare insurance limits to modeled losses:

• At 90th percentile loss scenario: does coverage exceed loss?
• At 95th percentile: coverage gap = [amount]
• At 99th percentile: catastrophic gap = [amount]
• Retention/deductible impact on net recovery
• Claims process timeline vs. cash flow needs

Step 5.4 -- Insurance Optimization

Recommend improvements:

• Limit increases for highest-gap scenarios
• Sub-limit negotiation priorities
• Exclusion modification requests
• Alternative risk transfer: captive insurance, parametric triggers
• Premium optimization through demonstrable security maturity

============================================================ PHASE 6: REPORT AND RISK DASHBOARD

Write the complete analysis to docs/cyber-risk-model.md.

Step 6.1 -- Executive Risk Dashboard

Produce a board-ready risk summary:

• Top 10 risk scenarios ranked by ALE
• Loss exceedance curve (probability vs. loss amount)
• Risk appetite alignment heat map
• Control effectiveness scorecard
• Insurance coverage adequacy summary
• Year-over-year risk trend (if historical data available)

Step 6.2 -- Risk Treatment Roadmap

Prioritize treatments by timeline:

• Immediate: risks exceeding appetite with available controls
• Short-term (1-3 months): insurance adjustments, quick control wins
• Medium-term (3-12 months): control investments, architecture improvements
• Long-term (12+ months): risk culture, governance maturity, emerging risk monitoring

============================================================ SELF-HEALING VALIDATION (max 2 iterations)

After producing output, validate data quality and completeness:

1. Verify all output sections have substantive content (not just headers).
2. Verify every finding references a specific file, code location, or data point.
3. Verify recommendations are actionable and evidence-based.
4. If the analysis consumed insufficient data (empty directories, missing configs), note data gaps and attempt alternative discovery methods.

IF VALIDATION FAILS:

• Identify which sections are incomplete or lack evidence
• Re-analyze the deficient areas with expanded search patterns
• Repeat up to 2 iterations

IF STILL INCOMPLETE after 2 iterations:

• Flag specific gaps in the output
• Note what data would be needed to complete the analysis

============================================================ OUTPUT

Cyber Risk Model Complete

• Report: docs/cyber-risk-model.md
• Risk scenarios quantified: [count]
• Control domains assessed: [count]
• Insurance coverage gaps identified: [count]
• Monte Carlo iterations: [count]

Summary Table

Area	Status	Priority
Risk Quantification	[Quantified/Semi-Quantitative/Qualitative Only]	[P1/P2/P3]
Control Effectiveness	[Strong/Moderate/Weak]	[P1/P2/P3]
Risk Appetite Alignment	[Aligned/Partially/Misaligned]	[P1/P2/P3]
Insurance Adequacy	[Adequate/Gaps/Significant Gaps]	[P1/P2/P3]
Residual Risk	[Acceptable/Elevated/Unacceptable]	[P1/P2/P3]

NEXT STEPS:

• "Run /threat-triage to update threat landscape inputs for risk scenarios."
• "Run /incident-response to validate response capability reduces loss magnitude."
• "Run /alert-prioritization to align detection investments with highest-risk scenarios."

DO NOT:

• Do NOT present risk as single-point estimates -- always use ranges and confidence levels.
• Do NOT conflate compliance with risk reduction -- passing an audit does not mean risk is acceptable.
• Do NOT model insurance as complete risk elimination -- coverage has limits, exclusions, and claims risk.
• Do NOT ignore correlated risks -- aggregation risk can exceed the sum of individual risks.
• Do NOT use fear-based language to inflate risk -- quantify objectively and let the numbers speak.

============================================================ SELF-EVOLUTION TELEMETRY

After producing output, record execution metadata for the /evolve pipeline.

Check if a project memory directory exists:

• Look for the project path in ~/.claude/projects/
• If found, append to skill-telemetry.md in that memory directory

Entry format:

### /cyber-risk-modeling — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}

Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.