/exposure-risk-quantification

name: exposure-risk-quantification
description: "FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownership-aware factors: exposure/threat/impact), an ownership + proof demotion cap so unproven or weakly-owned findings can't inflate the number, a $-denominated FAIR loss-magnitude estimate (IBM/Ponemon per-record cost bands, cross-source record dedup, threat-factor annualization), attack-path amplification (curated red-team chain catalog + generic graph-walk engine, with a kill-chain vs shared-fate honesty gate), and a board-ready one-pager deliverable (hero $ + letter grade + top-3 findings + top attack path + the ask). Extends osint-methodology's severity rubric and client deliverable templates with quantification. Passive analysis only -- operates on findings already collected, no target traffic, no API keys. Use when asked to score risk, quantify exposure, estimate breach cost, build a board report, translate technical findings to dollars, or explain why a grade or dollar figure came out the way it did."
version: 1.0
triggers:
  - risk score
  - risk quantification
  - cyber risk quantification
  - CRQ
  - FAIR methodology
  - FAIR score
  - loss event frequency
  - loss magnitude
  - risk grade
  - letter grade risk
  - A-F grade
  - 0-100 risk score
  - board report
  - board deliverable
  - board ready
  - executive summary risk
  - CISO report
  - hero number
  - dollar exposure
  - breach cost estimate
  - loss estimate
  - annualized loss expectancy
  - ALE
  - per-record cost
  - IBM Ponemon
  - cost of a data breach
  - exposed record count
  - quantify risk
  - risk translation
  - attack path
  - kill chain
  - shared fate exposure
  - attack path amplification
  - ownership confidence
  - proof demotion cap
  - confidence cap
  - TENTATIVE inflate score
  - risk trend
  - risk delta
  - the ask
  - remediation ask
  - one-pager
  - exposure risk
  - business impact translation
  - dominant risk driver

Exposure Risk Quantification — FAIR Scoring, $-Loss, and the Board Deliverable

> Companion skill: `osint-methodology` (the "how to think" recon skill — see its §9 severity > rubric and §16 client deliverable templates). This skill is the "how to quantify and > present" layer on top of a finished recon pass: it takes findings the methodology skill's > pipeline already produced and turns them into a number a board will act on.

0. When to Use / When NOT

**Use this skill when:** you have a completed set of recon findings (from any engagement, not just one tool's output) and need to (a) compute a defensible 0–100 + A–F risk score, (b) estimate a $-denominated loss range, (c) rank attack-path chains by exploitability, or (d) assemble a board/exec one-pager. Also use it to *explain* a score — "why did this grade come out D and not F" is exactly what §7 is for.

**Do NOT use this skill when:** you still need to go collect findings — that's `osint-methodology` (methodology) / `offensive-osint` (arsenal). This skill does not probe anything; it has nothing to say until a recon pass has already produced findings, assets, and (ideally) ownership/proof annotations.

---

1. Posture: Passive Analysis, Not New Recon

Every computation in this skill is a **pure function over findings + assets you already hold** — no network calls, no new probes, no target traffic. The reference implementation (`reporting/{risk_score,loss_model,board_report,board_render,attack_paths, attack_graph,owner_confidence,proof}.py`) is explicit about this: `risk_score.py` docstring calls itself "Pure compute over `scan.db` — no network, no schema change"; `loss_model.py` calls itself "Pure, no network"; `attack_graph.py` calls itself "Pure + offline."

That means this skill inherits the authorization posture of whatever collected the inputs (see `osint-methodology` §1) but adds none of its own — quantifying findings you already lawfully hold is never itself an intrusive act. It also means the outputs are only as good as the inputs: garbage findings (unowned namesakes, unverified snippet matches) produce a garbage score unless you apply the demotion cap in §7.5 first.

---

2. Confidence Levels

Reuses `osint-methodology` §2 verbatim — every finding you're about to score already carries one of:

| Level | Meaning | |---|---| | **TENTATIVE** | Plausible, unverified. | | **FIRM** | Directly observed, uncorroborated. | | **CONFIRMED** | Multiple independent corroborations OR directly verified. |

What this skill adds is a second, orthogonal axis — **ownership certainty** — and the rule for how the two combine so neither one alone can inflate a number (§7.5).

---

3. Output Format

Three artifacts, each a pure dataclass with a `to_dict()`:

OrgRisk:
  risk: float            # 0-100 headline
  grade: str              # A|B|C|D|F
  exposure, breach_likelihood, impact: float   # the three factors x100
  dominant_driver: str    # "exposure" | "breach-likelihood" | "business-impact"
  narrative: str          # 2-3 sentence board-language explanation

LossEstimate:
  records: int
  low, expected, high: float     # $ range
  annualized: float | None
  basis: str              # human-readable "N records x $X/record (source)" string

BoardSummary:
  target, hero (HeroNumbers), top_findings[], top_paths[], the_ask[], methodology, narrative

**Rule: every number ships with its basis.** `LossEstimate.basis` and `OrgRisk.narrative` are not optional decoration — never present the bare `risk` float or `expected` dollar figure without the sentence that explains what drove it. §4 and §12 make this a hard rule, not a style preference.

---

4. Source Hygiene & Assumption Disclosure

For every quantified number, disclose:

• **The cost band used** and its source (default: IBM/Ponemon Cost of a Data Breach,

~$165/record — see §8.1). If you swapped in a region/industry-tuned band, say so.

• **The record count's pr