Your board asks what it's worth. Answer with an actual figure.
Our Quantitative Risk Assessment turns a red, amber and green register into an expected annual loss for each risk scenario, set against the loss your board will accept, with a costed roadmap ranked by return. For the Head of IT who has to fund the fix.
Illustrative. Figures come from the estimator's example inputs, which are placeholders, not benchmarks.
The problem
A colour on a scale doesn't get funded.
Most cyber registers rank findings by severity label. That tells the board what is wrong. It doesn't say what the risk is worth, or what fixing it returns. Finance can't compare a high with a capital project, so your budget request competes on opinion. We give you a number to put in its place.
3
2–3
£
CSF 2.0
Try it on your own numbers
Estimate your exposure before we meet.
Enter your own loss ranges, rate your controls and set the loss you'd accept. The estimator gives an indicative expected annual loss and shows the gap to close. It runs in your browser. Nothing you type is sent to us.
What would each scenario cost you?
Give a realistic low and high for one occurrence, and how often it might happen with no controls at all.
How well are your controls working?
Rate each NIST CSF 2.0 function. Be honest: this is the self-assessment the real engagement tests.
What annual loss would your board accept?
The line your expected loss is measured against.
Indicative only. The example figures are placeholders, the control weightings are simplified, and your ratings are self-assessed. The assessment replaces all three with evidence from your estate.
What we cover
Three phases. One number the board can use.
Each output feeds the next, so the figure your board sees traces back to evidence from your own estate.
Risk scenario baselining
A workshop that agrees the two or three loss scenarios that matter most to you and costs each as a pound range, built from your revenue, data, regulation and sector.
Talk to us →Risk tolerance
We capture the level of loss you'll accept before a scenario needs active remediation, so every figure has a line to be measured against.
Talk to us →Control effectiveness
People, process and technology controls assessed against NIST CSF 2.0 through interviews, policy review, walkthroughs, configuration review and, where in scope, testing.
Talk to us →Threat exposure mapping
We trace the route each scenario could take to materialise, so the assessment concentrates on the controls that change the loss.
Talk to us →Quantified risk register
An expected annual loss for each scenario, set against your tolerance and mapped to control effectiveness. A register you can defend to finance as well as to IT.
Talk to us →Costed roadmap by return
Remediation cost set against the loss reduction it buys, sorted into quick wins, risk-reduction priorities, structural investment, and items to accept and monitor.
Talk to us →Why SysGroup
A number you can take to the board and defend there.
We build every figure from your own profile and evidenced controls, so it survives the first hard question from finance.
Testing from a CREST-approved practice
Where evidence is thin, we scope in technical testing such as penetration testing before we rate a control. The rating follows the evidence.
Led by a risk specialist
Ryan King leads the assessment and the risk position. His background is Big 4 risk consulting, so the report is built to stand up to scrutiny.
Pounds, in place of adjectives
Every scenario carries an expected annual loss in the same currency as any other business risk. Finance can weigh it against a capital project on equal terms.
A register that stays current
Run the same three phases on a cycle and your register becomes a live, ranked backlog that moves as your controls and threats change.
Open about the foundations
The method rests on public frameworks such as NIST CSF 2.0, so your auditors and your board can see what the number is built on.
We can fix what we find
Alex Harris's team covers remediation across infrastructure and Microsoft 365. SysGuard and SysProve pick up detection, response and compliance once the roadmap is agreed.
How we work
From first workshop to a roadmap finance can fund.
Depth follows evidence. A light-touch workshop is enough where your team can speak confidently to its controls. Where evidence is thin, we test first and rate after.
Scope
We agree the two or three scenarios, your risk tolerance and how deep the evidence needs to go.
Deliver
Workshops with your control owners, policy and configuration review, and technical testing where the evidence is thin.
Report
A quantified risk register and a costed roadmap ranked by return on investment.
Debrief & Validate
We walk your leadership and finance team through the numbers, then re-run the model as your controls change.
Start here
Book a baselining workshop.
The workshop is Phase 1 of the assessment. You leave with two or three costed risk scenarios and a risk tolerance figure, and you haven't committed to anything else.
- Two or three risk scenarios, each costed as a pound range
- A risk tolerance figure agreed with you
- Led by a named SysGroup risk specialist
- A clear view of what Phase 2 would need to assess
Your data is handled under our privacy policy. We will only use your details to respond to your enquiry.
Risk, priced, gets the funding it deserves.
A colour on a scale doesn't. Bring us the register your board keeps questioning, and we'll show you what it's worth.