Improving Decisions with DecipherRisk™️ Cost-Benefit Analysis (Scenario Cloning and Comparisons Features)

Improving Decisions with DecipherRisk™️ Cost-Benefit Analysis (Scenario Cloning and Comparisons Features)

For many leaders, the cost-benefit analysis is an invaluable tool for making investment and budget decisions. It gives leaders a process to assess the tangible and intangible costs and benefits associated with a given project/solution and provides a more objective and defensible decision framework. 

For risk managers and cyber security teams, performing a cost-benefit analysis on a risk mitigation solution is nearly impossible unless you are using a quantitative risk analysis method like Open FAIR™️. Using quantitative risk analysis allows side-by-side comparison of two or more risk scenarios, the "AS-IS" scenario before the control is applied (aka inherent risk), and the "TO-BE" scenario after the control is applied (aka residual risk).

Cost-Benefit Analysis with DecipherRisk™️

DecipherRisk™️ includes two features that have made cost-benefit analysis easier than ever. The first is the Cloning feature that gives users the ability to make an identical copy of a risk scenario in seconds. The second is the Comparisons feature, which gives users the ability to quickly compare up to three scenarios or Scenario Portfolios in just a few mouse clicks. 

Details on how to use both of these features are below.

DecipherRisk™️ Cloning Feature

Overview

With the DecipherRisk™️ Cloning feature, a risk analyst can make an exact copy of a scenario. This can save a significant amount of time when doing a cost-benefit or any other type of comparative analysis. To do this, the analyst creates the AS-IS (inherent) risk scenario. Then instead of having to create the TO-BE (residual) risk scenario from scratch, they would simply clone and edit the AS-IS scenario. 

As an example, if a risk analyst is performing a cost-benefit analysis on a new proposed IT security system that would reduce the organization's vulnerability to a specific cyberattack, the analyst would complete the AS-IS scenario, clone it to create the TO-BE scenario, and modify the TO-BE scenario's Open FAIR™️ Vulnerability value (e.g. reduce it from 20% to 5%) and associated assumptions/rational.

To create a clone of a risk scenario:

• Open the scenario you want to clone. 
• Select the "Clone Risk Scenario" button in the upper right-hand corner of the screen. (see Figure 1)

Figure 1 - Scenario clone

• Edit the Title of the clone (by default, the clone will have the same name with "clone" appended to the end. (see Figure 2)

Figure 2 - Clone Title Edit

DecipherRisk™️ Comparison Feature

Overview

The DecipherRisk™️ Comparison feature allows for up to three risk scenarios (and/or risk Portfolios) to be compared side-by-side.  As part of a cost-benefit analysis, this gives an analyst a way to describe and quantify the benefit (risk reduction) associated with a given risk treatment strategy (e.g. applying a new mitigative control).

Instructions

To compare risk scenarios:

• Select the scenarios you want to compare (up to three) by placing a check in the check box on the risk register (see Figure 3).

Figure 3 - Risk register scenario selection

• When you select the first scenario, a modal window will appear with two options - Compare and Modify (see Figure 4).

Figure 4 - Risk scenario Compare feature

• After selecting the scenarios you want to compare, select the Compare button on the modal window (see Figure 5).

Figure 5 - Create Compare modal window

• Enter information in the fields related to the comparison.

1. Title
2. Description for the comparison
3. Acceptable loss threshold* 
4. Description for each of the selected scenarios

• Hit submit

* This is a Value at Risk (VaR) that you can specify. The comparison will provide a probability that each scenario being compared will exceed the VaR. (see Figure 6)

Figure 6 - Acceptable Loss Threshold - Value at Risk

• A new comparison will be created (see Figure 7).

Figure 7 - Comparison visualizations

• The new comparison will show up in the Comparisons register in the Risk module (see Figure 8).

Figure 8 - Comparisons register

• To edit the Comparison details or the percentiles displayed in the comparison view, select Modify Comparison or Modify Percentiles button from within the Comparison window (see Figure 9).

Figure 9 - Modify Comparison information and Percentiles displayed