From CVSS to Dollars
CVSS (Common Vulnerability Scoring System) measures the technical severity of a vulnerability in isolation — exploitability, attack vector, impact on confidentiality, integrity, and availability. It does not consider your specific environment, the value of the exposed asset, how actively the exploit is being weaponized, or the regulatory and reputational consequences of a breach. The result is a prioritization problem. A CVSS 9.8 on a dev server with no sensitive data is not the same business risk as a CVSS 6.5 on the system that processes customer payment data. CVSS-only prioritization routinely causes teams to spend cycles on findings that generate little business impact while higher-dollar exposures sit unaddressed. Leverage Cyber replaces that single-dimension score with ALE: the expected financial loss per year if the finding remains open. Every finding in your report carries an ALE figure, and your remediation roadmap is ordered by ALE descending — highest financial exposure gets addressed first, every time.The Risk Quantification Model
Leverage Cyber calculates ALE for each finding by combining four inputs that together represent the true business exposure of a vulnerability. Asset Value estimates what a breach of the specific asset would cost your organization. This is not the replacement cost of the hardware or software — it is the cost of the event: incident response, forensic investigation, legal counsel, regulatory fines, customer notification, and downstream operational disruption. Leverage Cyber derives asset value from your industry sector, company size, and the sensitivity classification of data associated with the asset. Threat Likelihood quantifies how frequently this attack type succeeds against organizations with a similar exposure profile. Leverage Cyber draws on industry breach frequency databases, EPSS exploit likelihood scores, and active threat intelligence to assign a realistic annual probability of exploitation rather than a theoretical worst-case. Exposure Window captures how long the vulnerability has been externally observable. A misconfiguration that has been visible to threat actors for 18 months carries materially higher risk than one introduced last week. A longer exposure window increases the likelihood that adversaries have already discovered and staged the asset for future exploitation. Business Context adjusts the base calculation for factors specific to your organization: revenue impact from operational downtime, applicable regulatory frameworks (PCI-DSS, HIPAA, SOC 2, GDPR), and reputational damage potential based on your industry and customer profile. A healthcare organization and a SaaS startup with the same exposed credential face different regulatory consequences — business context ensures the ALE reflects your actual risk, not an industry average.Example Risk Calculation
The table below shows a sample set of findings from a real-world assessment, with the ALE figures that would appear in your executive report.
Each row represents a discrete finding from passive reconnaissance. The leaked executive credentials carry the highest ALE because credential stuffing is a high-frequency, low-barrier attack type and the potential breach cost of an executive account compromise — privileged access, wire fraud exposure, business email compromise — is substantial. No DMARC enforcement enables Business Email Compromise fraud impersonating your domain; the threat likelihood is medium because DMARC enforcement status is widely checked by BEC toolkits. The orphaned staging subdomain scores lower ALE despite meaningful asset exposure because the attack requires more adversary effort to monetize.