Risk model: how likelihood and impact grades are computed
Grades are computed by a script from accepted public reports and are never typed by hand. The model produces two grades per incident type and no single score.
Likelihood
Input: accepted primary and secondary reports for the incident published in the last 5 years, counted once per organisation.
| Reports in 5 years | Grade |
|---|---|
| 6 or more | high |
| 3 to 5 | medium |
| 2 | low |
| fewer than 2 | not published |
Label: "Likelihood: grade (n public reports in 5 years)". An incident page can be published with one recent report and older reports from a second organisation; its likelihood then reads "not published".
Impact
Input: the impact class each accepted report states: availability, data, money, compliance, degraded or unstated. Unstated reports are ignored.
| Majority of reports with a stated impact | Grade |
|---|---|
| data, money or compliance | high |
| availability | medium |
| degraded | low |
| fewer than 2 reports state impact | unrated |
Label: "Impact: grade (k of n reports: dominant class)". A tie between grades resolves to the higher grade.
Time to detection
Recorded only when a report states both the change time and the detection time. Group pages print the median with the count behind it and exclude values above the site-wide 95th percentile. An incident with fewer than 2 values prints no figure.
Current grid
| Likelihood \ Impact | Impact: high | Impact: medium | Impact: low |
|---|---|---|---|
| Likelihood: high | 0 | 0 | 0 |
| Likelihood: medium | 1 | 15 | 1 |
| Likelihood: low | 7 | 19 | 4 |
| Impact unrated or likelihood not graded | 11 | ||
Table equivalent: incidents per cell
What the model does not do
It does not weight by company size, industry or opinion. It does not produce a single score. It does not rank incidents against each other beyond the grid cells.