Finance & Banking
,
Governance & Risk Management
,
Industry Specific
KPMG’s Natasha Passley on Using CRQ to Show Cyber Risk in Financial Terms
Financial services organizations are increasingly turning to cyber risk quantification, or CRQ, to overcome the long-standing communication gap between security teams and executive boards in discussing cyber risks and investments.
See Also: Preparing for New Cybersecurity Reporting Requirements
Traditional security reporting typically focuses on technical metrics such as patch compliance rates or blocked threats, but these statistics often fail to resonate with board members seeking business-focused insights. CRQ transforms this dialogue by converting technical concerns into financial terms that align with how boards evaluate other business risks.
“What they want to see is, ‘What do I stand to lose?’ ‘What is the monetary value or business impact that I’m standing to lose in the event of an attack?’ That’s where cyber risk quantification can support with that,” said Natasha Passley, partner, cyber security, financial services lead at KPMG Australia. “Cyber risk quantification looks at modeling some of those threat scenarios that could be facing the business, and what that means in terms of the probability of them happening and the impact to the business. And that’s actually messaging and communication that resonates with boards.”
Organizations don’t need to abandon established frameworks such as NIST or ISO 27001, Passley said. CRQ complements these approaches by adding the financial dimension that boards require for informed decision-making, helping security leaders demonstrate how investments directly reduce specific business risks.
In this video interview with Information Security Media Group, Passley also discussed:
- How Monte Carlo simulations help model potential cyber incident scenarios and their financial impacts;
- Why traditional frameworks struggle to show year-over-year risk reduction progress effectively;
- How quantification enables more strategic investment decisions by highlighting residual risk areas.
Passley specializes in evaluating security implementations and assessing cyber maturity using industry-standard frameworks. She is responsible for prioritizing solutions to mitigate risk and define strategies that align with clients’ long-term business, security and compliance objectives.
link