Governance

Cyber Risk Quantification

FAIR model · Monte Carlo loss exposure in BDT crore · control what-if and return on security spend

ScenarioCompromise of RO user credentialsRansomware on case-management serversInsider misuse of STR dataPayment-message manipulation (SWIFT)DDoS on the Whistleblower PortalHarvest now, decrypt later

With controlNonePasskeys for every RO userEdge geo, bot and rate rulesImmutable backups and DR drillsHSM quorum on payment keysTokenisation and DLPPost-quantum re-wrap of sealed data

Annualised loss (mean)

৳ 5.53 crore

no added control

Median year

৳ 3.66 crore

21% of years have no loss

90th percentile

৳ 13.6 crore

1 year in 10 is worse

99th percentile (VaR)

৳ 23.6 crore

1 year in 100 is worse

P(loss > appetite)

0.7%

appetite ৳ 25.0 crore

Inputs · Compromise of RO user credentials

Stolen RO credentials used to read RFIs or file false reports

Threat events per year6.00

Vulnerability (chance an event succeeds)0.25

Primary loss per event1.20 cr

Secondary loss per event (40% of events)3.50 cr

Risk appetite (annual loss)৳ 25.0 crore

Loss event frequency

1.50 / yr

10,000 simulated years · PERT inputs · Poisson events

Expected events per decade15.0

Control appliedNone

Seed20261027 (repeatable)

Distribution of annual loss · years with a loss

0৳ 13.6 crore৳ 27.1 crore

Mean90th percentileAppetite

Loss exceedance curve · chance that annual loss exceeds x (%)

0৳ 13.6 crore৳ 27.1 crore

With selected control

Control what-if · return on security spend

Control	ALE with control	Reduction	Annual cost	ROSI	Verdict
Passkeys for every RO user	৳ 2.49 crore	৳ 3.04 crore	৳ 1.20 crore	154%	Invest
Edge geo, bot and rate rules	৳ 3.55 crore	৳ 1.98 crore	৳ 0.40 crore	395%	Invest
Immutable backups and DR drills	৳ 1.90 crore	৳ 3.64 crore	৳ 2.50 crore	46%	Consider
HSM quorum on payment keys	৳ 2.11 crore	৳ 3.42 crore	৳ 0.80 crore	328%	Invest
Tokenisation and DLP	৳ 1.94 crore	৳ 3.59 crore	৳ 1.80 crore	99%	Invest
Post-quantum re-wrap of sealed data	৳ 1.06 crore	৳ 4.47 crore	৳ 1.50 crore	198%	Invest

Method · FAIR with Monte Carlo

LEF  = TEF × Vulnerability × control effect        # loss events per year
N    ~ Poisson(LEF)                                   # events in one simulated year
loss = Σ_k [ PL_k + B_k × SL_k ],   B_k ~ Bernoulli(0.4)
PL_k ~ PERT(0.3·PL, PL, 3·PL)   SL_k ~ PERT(0.2·SL, SL, 4·SL)   (λ = 4)
TEF  ~ PERT(0.5·TEF, TEF, 2·TEF)   Vuln ~ PERT(0.6·V, V, 1.4·V)
ALE  = mean over 10,000 years · VaR99 = 99th percentile
ROSI = (ALE_without − ALE_with − annual cost) ÷ annual cost
PERT is sampled as a scaled Beta(α, β) from two Gamma draws (Marsaglia–Tsang)

Control

ALE with control

Reduction

Annual cost

ROSI

Verdict

Passkeys for every RO user

৳ 2.49 crore

৳ 3.04 crore

৳ 1.20 crore

154%

Invest

Edge geo, bot and rate rules

৳ 3.55 crore

৳ 1.98 crore

৳ 0.40 crore

395%

Invest

Immutable backups and DR drills

৳ 1.90 crore

৳ 3.64 crore

৳ 2.50 crore

46%

Consider

HSM quorum on payment keys

৳ 2.11 crore

৳ 3.42 crore

৳ 0.80 crore

328%

Invest

Tokenisation and DLP

৳ 1.94 crore

৳ 3.59 crore

৳ 1.80 crore

99%

Invest

Post-quantum re-wrap of sealed data

৳ 1.06 crore

৳ 4.47 crore

৳ 1.50 crore

198%

Invest

LEF = TEF × Vulnerability × control effect # loss events per year N ~ Poisson(LEF) # events in one simulated year loss = Σ_k [ PL_k + B_k × SL_k ], B_k ~ Bernoulli(0.4) PL_k ~ PERT(0.3·PL, PL, 3·PL) SL_k ~ PERT(0.2·SL, SL, 4·SL) (λ = 4) TEF ~ PERT(0.5·TEF, TEF, 2·TEF) Vuln ~ PERT(0.6·V, V, 1.4·V) ALE = mean over 10,000 years · VaR99 = 99th percentile ROSI = (ALE_without − ALE_with − annual cost) ÷ annual cost PERT is sampled as a scaled Beta(α, β) from two Gamma draws (Marsaglia–Tsang)