> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/concepts/risk/quantitative-risk-studies.md).

# Quantitative risk studies

A **quantitative risk study** evaluates risk in monetary terms — the expected annualised loss from each scenario — using probabilistic methods rather than a qualitative matrix.

It's the sibling of qualitative risk assessment and EBIOS RM: same problem (what could go wrong, how bad would it be), different lens (statistics rather than categories).

## Mental model

```mermaid
graph LR
  D[Domain] -->|scopes| S[Study]
  S -->|comprises| SC[Scenario]
  SC -->|comprises| H[Hypothesis]
  SC -.->|impacts| A[Asset]
  SC -.->|exploits| V[Vulnerability]
  H -.->|assumes| AC[Applied control]
```

A study is the container for one quantitative analysis. It comprises scenarios — each one a discrete risk being modelled — and each scenario comprises one or more hypotheses, typically one per risk stage (inherent / current / residual). The hypothesis carries the probability and impact distributions plus the applied controls it assumes are in place — split into existing / added / removed sets so the delta between stages is explicit. Scenarios reference the assets they impact and the vulnerabilities they exploit, mirroring the qualitative side of the platform.

| User-facing | Internal                     | Notes                                              |
| ----------- | ---------------------------- | -------------------------------------------------- |
| Study       | `QuantitativeRiskStudy`      | Container; carries risk tolerance + loss threshold |
| Scenario    | `QuantitativeRiskScenario`   | One row of risk                                    |
| Hypothesis  | `QuantitativeRiskHypothesis` | Parameter set + Monte-Carlo simulation cache       |

## How it works

Each **scenario** in the study is parametrised by one or more **hypotheses**:

* A **loss-event frequency** distribution — how often the bad thing happens per year, expressed as a distribution rather than a point estimate.
* A **loss magnitude** distribution — how much it costs when it happens, also as a distribution.

The platform runs Monte-Carlo simulation over those distributions and derives the loss exceedance curve (LEC) plus aggregate metrics: expected loss, value-at-risk, tail loss.

## When to use it

* You need to compare risk against budget — "should we spend €X on control Y?" becomes tractable when both sides are in euros.
* You need to talk to the board or finance about risk in the language they speak.
* You have enough data — or enough informed judgement — to bound the loss distributions.

Qualitative methods stay useful for everything else.

## Related

* [Risk assessments](/ciso-assistant/concepts/risk/risk-assessments.md)
* [EBIOS RM](/ciso-assistant/concepts/risk/ebios-rm.md)
* [Guide → Cyber risk quantification](/ciso-assistant/guides/assessments/quantitative-risk.md) — click walkthrough for running a study.
* [Guide → Cyber risk quantification methodology](/ciso-assistant/guides/assessments/quantitative-risk-methodology.md) — the math behind the LEC, VaR, expected shortfall, ROSI, and tolerance overlay.
* [Vocabulary → Quantitative risk study / scenario / hypothesis](/ciso-assistant/introduction/vocabulary.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/concepts/risk/quantitative-risk-studies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.