> ## Documentation Index > Fetch the complete documentation index at: https://docs.leveragecyber.io/llms.txt > Use this file to discover all available pages before exploring further. # Risk Quantification: Cyber Risk in Business Terms > Learn how Leverage Cyber converts every technical finding into a dollar figure — giving leadership the financial context needed to act. Security teams have long communicated risk through CVSS scores and severity labels, but a "9.8 Critical" means nothing to a CFO deciding budget allocation or a board evaluating enterprise risk. Leverage Cyber solves this translation problem by converting every finding into Annual Loss Expectancy (ALE) — a dollar figure that expresses exactly what a vulnerability costs your organization if left unaddressed. That number travels from the security team to the boardroom without losing meaning. ## From CVSS to Dollars CVSS (Common Vulnerability Scoring System) measures the technical severity of a vulnerability in isolation — exploitability, attack vector, impact on confidentiality, integrity, and availability. It does not consider your specific environment, the value of the exposed asset, how actively the exploit is being weaponized, or the regulatory and reputational consequences of a breach. The result is a prioritization problem. A CVSS 9.8 on a dev server with no sensitive data is not the same business risk as a CVSS 6.5 on the system that processes customer payment data. CVSS-only prioritization routinely causes teams to spend cycles on findings that generate little business impact while higher-dollar exposures sit unaddressed. Leverage Cyber replaces that single-dimension score with ALE: the expected financial loss per year if the finding remains open. Every finding in your report carries an ALE figure, and your remediation roadmap is ordered by ALE descending — highest financial exposure gets addressed first, every time. ## The Risk Quantification Model Leverage Cyber calculates ALE for each finding by combining four inputs that together represent the true business exposure of a vulnerability. **Asset Value** estimates what a breach of the specific asset would cost your organization. This is not the replacement cost of the hardware or software — it is the cost of the event: incident response, forensic investigation, legal counsel, regulatory fines, customer notification, and downstream operational disruption. Leverage Cyber derives asset value from your industry sector, company size, and the sensitivity classification of data associated with the asset. **Threat Likelihood** quantifies how frequently this attack type succeeds against organizations with a similar exposure profile. Leverage Cyber draws on industry breach frequency databases, EPSS exploit likelihood scores, and active threat intelligence to assign a realistic annual probability of exploitation rather than a theoretical worst-case. **Exposure Window** captures how long the vulnerability has been externally observable. A misconfiguration that has been visible to threat actors for 18 months carries materially higher risk than one introduced last week. A longer exposure window increases the likelihood that adversaries have already discovered and staged the asset for future exploitation. **Business Context** adjusts the base calculation for factors specific to your organization: revenue impact from operational downtime, applicable regulatory frameworks (PCI-DSS, HIPAA, SOC 2, GDPR), and reputational damage potential based on your industry and customer profile. A healthcare organization and a SaaS startup with the same exposed credential face different regulatory consequences — business context ensures the ALE reflects your actual risk, not an industry average. ## Example Risk Calculation The table below shows a sample set of findings from a real-world assessment, with the ALE figures that would appear in your executive report. | Finding | Asset Exposure | Threat Likelihood | Estimated ALE | | ---------------------------- | -------------- | -------------------------- | ---------------- | | Leaked executive credentials | \$450,000 | High (credential stuffing) | \$180,000/yr | | No DMARC enforcement | \$200,000 | Medium (BEC fraud) | \$90,000/yr | | Orphaned staging subdomain | \$120,000 | Medium (data exposure) | \$48,000/yr | | **Total Portfolio ALE** | | | **\$318,000/yr** | Each row represents a discrete finding from passive reconnaissance. The leaked executive credentials carry the highest ALE because credential stuffing is a high-frequency, low-barrier attack type and the potential breach cost of an executive account compromise — privileged access, wire fraud exposure, business email compromise — is substantial. No DMARC enforcement enables Business Email Compromise fraud impersonating your domain; the threat likelihood is medium because DMARC enforcement status is widely checked by BEC toolkits. The orphaned staging subdomain scores lower ALE despite meaningful asset exposure because the attack requires more adversary effort to monetize. ## How Findings Are Prioritized Your remediation roadmap ranks every finding by ALE descending. The highest-dollar-impact issue appears first, regardless of its CVSS score. This approach directly answers the question leadership actually asks: "If we can only fix three things this quarter, which three save us the most money?" Prioritizing by ALE also makes resourcing conversations straightforward. When a remediation item carries a $180,000/yr ALE and the fix requires four hours of engineering time, the ROI is self-evident. When a $48,000/yr ALE finding requires a complex vendor migration, your team can make an informed, documented decision to schedule it appropriately rather than treating it as an emergency. When presenting your ALE figures to leadership, lead with the total portfolio ALE and the estimated remediation cost side by side. Remediation costs are typically 5–8× less than the ALE they eliminate. A $318,000/yr ALE portfolio that costs $45,000 to remediate represents a 7× return on investment — a number any CFO or board audit committee can evaluate immediately.