Squalify

Defines and models specific cyber threat scenarios such as ransomware, data breach, business email compromise, or cloud outage as the unit of quantification, tying each scenario to a business decision rather than an enterprise-wide average. Scenario library breadth and support for custom scenario authoring vary across products.

Models the financial loss drivers that set the magnitude of each scenario, including incident response, business interruption, data recovery, regulatory fines, legal liability, and reputational harm. Coverage of secondary and long-tail losses varies across products.

Quantifies exposure to inform insurance coverage adequacy, policy limits, and risk-transfer decisions, and to justify control effectiveness during underwriting and renewal. Dedicated insurance modules are a differentiator rather than a universal capability.

Ranks and optimizes prospective security investments by financial risk reduction per unit of spend, supporting capital allocation, risk acceptance, and control-optimization decisions. Prescriptive optimization is stronger in some products than others.

Quantifies how the organization's existing security controls reduce financial exposure, expressing the monetary value of controls in place and the residual risk they leave. Products vary in whether control effectiveness is derived from observed data or from maturity self-assessment.

Runs Monte Carlo or equivalent simulation to express exposure as probability distributions and ranges, such as annualized loss exposure and loss-exceedance curves, rather than a single-point figure. Some products report only point estimates.

Translates quantified exposure into board-ready, CFO-ready, and executive-ready reporting in financial terms, supporting capital trade-offs, oversight, and budgeting and strategic-planning cycles. Reporting depth and boardroom framing vary across products.

Estimates how likely or how often each modeled scenario is to occur, drawing on threat intelligence, historical incident data, or actuarial loss datasets to ground the likelihood side of the calculation. Products differ in whether frequency is threat-intelligence-driven, actuarial, or expert-estimated.

Expresses the monetary impact of material cyber events for regulatory and disclosure obligations, such as SEC cyber disclosure and materiality assessment. Dedicated disclosure workflows are present in some products and absent in others.