Customer cases
At ACI Risk Measure, we work with organisations that seek a stronger foundation for decision-making in cybersecurity.
Our client cases provide insight into how risk quantification can be translated into concrete action – and how a shared language for cyber and IT risk can strengthen the dialogue between security, business, and leadership.
“Cybersecurity has been a strategic focus area for us for many years. The collaboration with ACI Risk Measure has provided us with a clear picture of our cyber risks in business terms. I am very impressed by the way ACI Risk Measure applies actuarial methods to calculate probabilities and associated costs. It translates risk into a language that is familiar and understandable to the board.”
QUANTIFYING CYBER RISK STRENGTHENS STRATEGIC DECISION-MAKING
Challenge
VELUX wanted a stronger foundation for discussing and prioritising cyber risks at executive level. The traditional red, yellow, and green heat maps (4×4 matrix) did not provide a true picture of what the risks actually meant for the business. The goal was therefore to establish a better way of communicating risk – one that could enhance understanding of the risks and their business impact, while supporting strategic choices and investment priorities that reduce risk where it creates the most value.
Approach
In collaboration with ACI Risk Measure, VELUX’s cyber risks were analysed and quantified through a series of workshops and data-driven assessments. The process combined the security team’s existing knowledge with business insights from leadership, enabling risks to be translated into concrete financial estimates. This made it possible to illustrate how different types of incidents could affect VELUX – both directly and indirectly – in financial terms, supported by statistical data.
Result
By quantifying the risks, cybersecurity could be communicated in a far clearer and more measurable way. The report summarising the results has been used as both a communication and prioritisation tool for management and the board, making it easier for the security team and leadership to speak from a common point of reference. It provided a clear picture of where efforts create the most value, increased transparency around budget needs, and strengthened the dialogue on priorities.
