Monty & CoMonty&CoLearn
Event Risk ExposureTools

Using Event Risk Exposure

Event Risk is a single-event Monte Carlo tool. Open it at /event-risk and you'll land on theCustomer data breach sample envelope — two cause drivers, two impact dimensions, two existing controls, two treatments. Edit it in place to see the engine respond; hit Sample to reset to it any time.

Assumes you understand the model. If not, start with What is single-event risk quantification?

The risk event

Top of the page. One model = one event. Two fields:

  • Model name — short identifier. Appears in exports, the browser tab title.
  • Event statement — what the event is, in noun form. "Loss of sensitive customer data" not "Hackers steal data" (that's a cause).

Causes

Each cause is a pathway to the event. Causes aggregate any-of — the event fires in an iteration if any cause's trigger roll succeeds. Each cause has:

  • A name (and optionally a description).
  • A likelihood mode — toggle between distribution (TRI / PERT with three probability parameters) and 5-band rating (Very Unlikely → Almost Certain with configured per-band probabilities).

Pick distribution mode when you can elicit a probability triple. Pick band mode when stakeholders are more comfortable on a qualitative scale.

Impacts

Each impact is a distinct consequence dimension. Impacts aggregate by sum — if the event fires, every impact contributes its sampled consequence to the total. Each impact has:

  • A name.
  • A consequence distribution — triangular, PERT, or fixed currency value. Same family as PRQ; refer toprobability distributions in PRQ for the choice guide.

Existing controls

Controls are interventions that are already running and reduce baseline risk. Each control has:

  • A name.
  • Applies to — multi-select of cause and / or impact IDs (click pills to toggle). The same control can apply to multiple causes AND multiple impacts simultaneously (e.g. MFA reduces likelihood of both phishing and credential- stuffing causes).
  • Likelihood reduction (%) — applied to every cause this control targets.
  • Consequence reduction (%) — applied to every impact this control targets.

A single control can carry both a likelihood AND a consequence reduction at once. Reductions stack multiplicatively across all controls targeting the same cause or impact: p_treated = p_base × (1 − r1) × (1 − r2) × …

Additional treatments

Treatments are hypothetical interventions you're considering investing in. Same structure as controls plus a cost — the investment required to deliver the treatment. Cost drives the cost-benefit / ROI computation on the results panel.

Running the simulation

Set the iteration count (10 000 is the default; bumps available up to 50 000 for tighter cost-benefit estimates), then hit ▶ Run simulation. The Monte Carlo loop runs in a Web Worker so the UI stays responsive even at 50 000 iterations with N treatments (the cost-benefit pass alone runs N+1 simulations).

If the Web Worker can't start (rare — restrictive corporate environments where workers are blocked), the simulation falls back to running on the main thread synchronously with a soft notice.

Reading the results

After Run, the page expands to show:

Run summary band

Event statement + run metadata (iteration count, cause + impact counts, timestamp) + the headline occurrence rate (frequency of "the event fired" across iterations).

Hero stat row

Baseline P80 contingency, treated P80 (when treatments are defined), and the portfolio ROI (treatment-portfolio expected- loss reduction / total treatment cost). With no treatments defined, the row shows baseline P50 + P80 + P90 in their semantic colours instead.

Total impact distribution

Baseline histogram with P50 / P80 / P90 percentile pills marked in the brand palette (green / teal / ink).

Cumulative S-curve

Probability that total impact stays at or below each x-value. Baseline curve in teal; treated overlay is on the roadmap (compare against treated P80 in the hero stat row for now).

Cost-benefit per treatment

One row per treatment: cost, marginal expected-loss reduction, ROI as an inline Pill (green when ≥ 1.0×, ochre when below). Read each row as "given the other treatments are in place, is this one worth its cost?"

Driver sensitivity

Three lists in side-by-side cards — causes / impacts / controls — each ranked by variance share. Tells you which driver to invest treatment effort against, and which controls are holding back the most variance today.

All percentiles + key findings

Seven percentile cells (P10 / P25 / P50 / P75 / P80 / P90 / P95) for the baseline run, plus mean, std dev, occurrence rate, and iteration count.

Exporting

Export JSON downloads the envelope as a portable file — same shape Event Risk reads on Import. Use for backup, version control, or handoff.

PDF report export is on the roadmap (same six-page A4-portrait treatment as the PRQ report, with the cost-benefit + driver- sensitivity sections as the headline differences). Will land in a follow-up slice.