Exposure simulator
Tick what your organization uses and see which assessment fits.
Open the full simulator5×5 risk matrix
Pick a scenario, adjust likelihood and impact and see which treatment usually fits: accept, mitigate, transfer or avoid. It is an illustrative simulation; your real risk is agreed with your business in an assessment.
Scenario
Illustrative simulationIt runs in your browser. We ask for no data and send nothing.
Systems and data encrypted with a payment demand.
12345
5
5
10
15
20
25
4
4
8
12
16
20
3
3
6
9
12
15
2
2
4
6
8
10
1
1
2
3
4
5
- Low 1–4
- Medium 5–9
- High 10–14
- Critical 15–25
With the keyboard: the arrow keys move around the matrix and Enter or Space pick the cell.
Likelihood 3 of 5 (Possible) times impact 5 of 5 (Severe) gives 15: critical risk.
Treatment
- AcceptTake the risk knowingly and review it from time to time.
- MitigateUsually fitsReduce it with controls that lower the likelihood or the impact.
- TransferShift part of the impact to a third party, for example with insurance or a contract.
- AvoidStop the activity or change the process that creates the risk.
Related assessments
- Audits and Risk AssessmentAssessment of network, identity, email, cloud and endpoint configuration
- Cyber Recovery and Data RecoveryRecovery after ransomware encryption when technical routes exist
- Incident Response and RansomwareTriage and containment of the incident
In a real assessment, likelihood and impact are agreed with your business and backed by technical evidence.
Each scenario's starting values are illustrative and do not describe any organization. Move them and watch the reading change.
How to read the matrix
Each cell is likelihood times impact. The levels group those values and each level has a usual reading.
| Level | Score | Usual reading |
|---|---|---|
| Low | 1–4 | Accepted and watched. |
| Medium | 5–9 | Mitigated with proportionate controls. |
| High | 10–14 | Mitigated with priority. |
| Critical | 15–25 | Acted on at once. |
How the suggested treatment is chosen
- Low risk: accept and keep watching.
- Medium or high risk: mitigate with proportionate controls, with priority on high.
- Critical risk: mitigate at once; if likelihood and impact are both 4 or more, avoid the activity that creates it.
- Low likelihood with high impact (likelihood of 2 or less and impact of 4 or more): besides mitigating, transferring part of the impact is usually considered, for example with insurance or a contract.
Start with a risk assessment
Tell us what you need assessed and how urgent it is. A SoluProTec specialist reviews your request and contacts you through the channel you provide.