Forecast cyber control failure loss

Forecast expected and tail cyber loss with locally pooled threat frequency, control reliability and lognormal loss severity, drawing one shared control state across every path it protects to preserve common-mode failure.

Forecasting & survival Forecast CTOs Tech CEOs IT managers Team leads Investors

What it's for

Gives CTOs and investors a locally calibrated cyber loss range that exposes common-mode control failure and avoids double-counting the same business asset across attack paths.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

Field	Type	Role	Required
business_assets	array of objects (3 fields) ≥ 1 item	Evidence	Yes
control_path_effects	array of objects (5 fields)	Evidence	Yes
control_prior_failures	number > 0	Your calibration	Optional
control_prior_successes	number > 0	Your calibration	Optional
controls	array of objects (3 fields)	Evidence	Yes
historical_control_tests	array of objects (4 fields)	Evidence	Yes
historical_loss_events	array of objects (4 fields)	Evidence	Yes
historical_threat_periods	array of objects (5 fields)	Evidence	Yes
horizon_periods	integer ≥ 1, ≤ 120	Your calibration	Optional
max_detail_rows	integer ≥ 1, ≤ 500	Numerical control	Optional
minimum_control_tests	integer ≥ 1	Your calibration	Optional
minimum_loss_events	integer ≥ 1	Your calibration	Optional
minimum_threat_periods	integer ≥ 1	Your calibration	Optional
scenarios	array of objects (7 fields)	Evidence	Yes
seed	integer ≥ 0	Numerical control	Optional
severity_prior_strength	number > 0	Your calibration	Optional
simulations	integer ≥ 100, ≤ 100000	Numerical control	Optional
tail_probability	number ≥ 0.001, ≤ 0.5	Your calibration	Optional
threat_paths	array of objects (6 fields)	Evidence	Yes
threat_prior_exposure_units	number > 0	Your calibration	Optional

Each `scenarios` record

Field	Type	Required
asset_loss_multiplier	number (≥ 0)	Yes
control_failure_multiplier	number (≥ 0)	Yes
evidence_verified	boolean	Yes
id	string (non-empty)	Yes
loss_severity_multiplier	number (≥ 0)	Yes
probability	number (≥ 0, ≤ 1)	Yes
threat_frequency_multiplier	number (≥ 0)	Yes

Example input

{
  "business_assets": [
    {
      "evidence_verified": true,
      "id": "payments",
      "value_at_risk": 100
    }
  ],
  "control_path_effects": [
    {
      "control_id": "access",
      "effectiveness_if_working": 0.7,
      "evidence_verified": true,
      "id": "access-credential",
      "path_id": "credential-path"
    },
    {
      "control_id": "detection",
      "effectiveness_if_working": 0.5,
      "evidence_verified": true,
      "id": "detection-credential",
      "path_id": "credential-path"
    },
    {
      "control_id": "detection",
      "effectiveness_if_working": 0.5,
      "evidence_verified": true,
      "id": "detection-session",
      "path_id": "session-path"
    }
  ],
  "controls": [
    {
      "control_class": "preventive",
      "evidence_verified": true,
      "id": "access"
    },
    {
      "control_class": "detective",
      "evidence_verified": true,
      "id": "detection"
    }
  ],
  "historical_control_tests": [

Truncated for display — the full payload is 264 lines.

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

Example output

{
  "asset_diagnostics": [
    {
      "asset_id": "payments",
      "expected_business_loss": 4.22,
      "simulated_loss_probability": 0.055,
      "value_at_risk": 100
    }
  ],
  "assumptions": [
    "Threat exposure periods include zero-attempt periods, control tests are prospectively defined and independently recorded, and direct loss marks are finance reconciled. Selective testing, right truncation or post-outcome class changes invalidate calibration.",
    "Each control draws one state per simulation that is shared across all paths it protects, preserving common-mode failure. Threat frequency, control failure, direct severity and business loss move together only through the submitted scenarios.",
    "Multiple paths reaching the same business asset combine multiplicatively and cannot lose more than its unique governed value. Direct response loss remains separate and additive across simulated successful paths.",
    "This is aggregate conditional decision support, not a breach forecast, attacker attribution, compliance or insurance opinion, vulnerability disclosure, or authority to investigate, notify, surveil, block or change production."
  ],
  "configuration": {
    "asset_loss_rule": "multiplicative_union_per_unique_asset",
    "control_prior_failures": 2,
    "control_prior_successes": 2,
    "control_state_model": "beta_binomial_shared_state_across_paths",
    "direct_loss_model": "partially_pooled_lognormal_marks",
    "minimum_control_tests": 5,
    "minimum_loss_events": 2,
    "minimum_threat_periods": 10,
    "seed": 19,
    "severity_prior_strength": 5,
    "tail_probability": 0.1,
    "threat_frequency_model": "empirical_bayes_gamma_poisson",
    "threat_prior_exposure_units": 20
  },
  "control_class_diagnostics": [
    {
      "control_class": "detective",
      "historical_test_count": 6,
      "historical_test_pass_fraction": 0.6667,
      "posterior_working_probability": 0.6,
      "support_sufficient": true
    },
    {
      "control_class": "preventive",
      "historical_test_count": 6,
      "historical_test_pass_fraction": 0.8333,
      "posterior_working_probability": 0.7,
      "support_sufficient": true

Truncated for display — the full payload is 106 lines.

How it works

Forecasting & survival — Estimate when something completes or fails, with censoring and unresolved work handled honestly rather than dropped.

1 Fit empirical-Bayes Gamma-Poisson threat rates from exposure periods including zeros, Beta-Binomial working probabilities from independent control tests, and partially pooled lognormal direct-loss marks.
2 Simulate coherent management scenarios, drawing one working state per control and simulation so a common control failure propagates across every protected path.
3 Union overlapping path loss multiplicatively within each unique asset, add separately defined direct response loss, and return expected loss, VaR/CVaR and support diagnostics only when local evidence gates pass.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Assumptions & guardrails

Training examples precede their outcomes, censoring and unresolved work are represented, and deployment populations remain comparable to validation cohorts.
Threat exposure, control tests and loss marks are complete at the declared class grain; scenarios share one horizon; path effects are prospective; direct and asset loss definitions do not overlap.
A predictive interval or risk estimate is not a deadline promise, causal explanation, or individual-performance judgment.
This is an aggregate conditional loss distribution, not a breach prediction, attacker attribution, legal/compliance/insurance opinion or authority to investigate, surveil, notify, block or change production.

Minimum evidence

historical_threat_periods: required and organization-defined
historical_control_tests: required and organization-defined
historical_loss_events: required and organization-defined
business_assets: at least 1 rows/items
threat_paths: required and organization-defined
controls: required and organization-defined
control_path_effects: required and organization-defined
scenarios: required and organization-defined

How to validate it

Use chronological train/calibration/test windows, compare proper scores and decision value with a simple baseline, and recalibrate only from outcomes resolved after prediction time.

Calibrating it to your org

Same for everyone

The mathematical kernel, validation rules, method version, and JSON output semantics are organization-independent; no tenant-trained coefficients or company benchmark is embedded in the function.

Specific to you

immutable tenant-local exposure/test/loss cohorts joined to one versioned threat/control graph and common scenario set, preserving zero periods, failed tests, class definitions, shared control identity and unique asset identity
threat/control class stability, exposure unit and horizon, selection/censoring rules, direct-versus-asset loss perimeter, control test independence, prospective effect evidence, scenario dependence, prior strength, local support gates, tail probability, value/currency and accountable security/risk/finance owners

Calibration workflow

1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "forecast expected and tail cyber loss" }
  → finds "forecast_cyber_control_failure_loss"

gitrevio_capability_describe
  { "capability_id": "forecast_cyber_control_failure_loss" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "forecast_cyber_control_failure_loss", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

Audit cyber control evidence integrity

Audit whether claimed defense in depth is supported by current independent control tests mapped to declared attack-path steps, while preserving duplicate mappings and counting each exposed business asset only once.

Statistical audit & measurement

Optimize cyber control portfolio

Find a budget-, capacity-, availability- and defense-depth-feasible cyber-control portfolio on a nonlinear attack-path graph, recomputing unique-asset expected loss and CVaR under dependencies, exclusions and multiplicative effects.

Network & dependency analysis

Audit data sovereignty residency evidence integrity

Audit every governed data asset's point-in-time storage, processing, replica, backup, log/cache and key locations plus cross-region transfers against an effective counsel-supplied residency policy, independent evidence, encryption controls and retention limits.

Constrained optimization

Audit software supply chain integrity

Audit the deployed runtime software supply chain from application roots through resolved dependency edges: reconcile SBOM freshness, version resolution, source pinning, artifact attestation, support horizon, license policy, vulnerability disposition, evidence coverage and unique application value without treating repository text as provenance or exploitability evidence.