Using Event Risk Exposure

Event Risk is a single-event Monte Carlo tool. Open it at /event-risk and you land on the Customer data breach sample: two cause drivers, two impact dimensions, two existing controls, two treatments. Edit it in place to see the engine respond; hit Sample to reset to it, New to start blank, or Import to load a saved model.

This guide assumes you understand the model. If not, start with What is single-event risk quantification?

The risk event

Top of the page. One model, one event. Two fields:

• Model name: short identifier. Names the export file.
• Event statement: what the event is, in noun form. "Loss of sensitive customer data", not "Hackers steal data" (that's a cause).

Causes

Each cause is a pathway to the event. Causes aggregate any-of: the event fires in an iteration if any cause's trigger roll succeeds. Each cause has:

• A name (and optionally a description).
• A likelihood mode: toggle between distribution (triangular or PERT over three probability parameters) and a 5-band rating (Very Unlikely through Almost Certain, with a configured probability per band).

Pick distribution mode when you can elicit a probability range. Pick band mode when stakeholders are more comfortable on a qualitative scale.

Impacts

Each impact is a distinct consequence dimension. Impacts aggregate by sum: if the event fires, every impact contributes its sampled consequence to the total. Each impact has:

• A name.
• A consequence distribution: triangular, PERT, or fixed currency value. Same families as PRQ; see probability distributions for the choice guide.

Existing controls

Controls are interventions that are already running and reduce baseline risk. Each control has:

• A name.
• Applies to: a multi-select of causes and impacts (click pills to toggle). The same control can apply to multiple causes and multiple impacts at once (e.g. MFA reduces the likelihood of both a phishing cause and a credential-stuffing cause).
• Likelihood reduction (%): applied to every cause this control targets.
• Consequence reduction (%): applied to every impact this control targets.

A single control can carry both a likelihood and a consequence reduction at once. Reductions stack multiplicatively across all controls targeting the same cause or impact: p_treated = p_base × (1 − r1) × (1 − r2) × …

Additional treatments

Treatments are hypothetical interventions you're considering investing in. Same structure as controls plus a cost: the investment required to deliver the treatment. Cost drives the cost-benefit computation on the results panel.

Running the simulation

Set the iteration count (presets from 1,000 to 50,000; 10,000 is the default), then hit Run simulation. The Monte Carlo loop runs in a Web Worker so the UI stays responsive. Baseline and treated runs share the same random draws, so the comparison between them is paired rather than noise-on-noise, and the cost-benefit pass re-runs the simulation once per treatment on the same draws.

If the Web Worker can't start (rare; some restrictive corporate environments block workers at the browser level), the same simulation runs on the main thread instead, with a notice shown alongside the results. The method and the results are unchanged.

Reading the results

After the run, the page expands to show:

Run summary band

Event statement and run metadata (iteration count, cause and impact counts, timestamp), plus the headline occurrence rate: the share of iterations in which the event fired.

Hero stat row

Baseline and treated figures at the chosen reporting percentile, with the reduction (when treatments are defined), and the total ROI: the joint expected-loss reduction of the whole treatment portfolio divided by its total cost. With no treatments defined, the row shows baseline P50, P80 and P90 in their semantic colours instead.

Above the stat row is the Reported at chooser: P50, P75, P80, P90, P95, the percentile the hero figures lead with. It defaults to P80 as a starting point rather than a recommendation, and the choice is stored on the envelope so it travels with an export. Changing it never re-runs anything, because every listed percentile came out of the same simulation. Which level an organisation reports and funds to is an appetite decision, covered on the methodology page.

Impact distribution if the event fires

A histogram of the iterations where the event fired, with dashed P50 / P80 / P90 markers in the brand palette (green, teal, ink). Read it carefully: the bars and markers are conditional, the distribution of what the event costs given that it happens. The hero row's headline P80 and the percentile strip below use all iterations including the zeros, so they're the unconditional exposure figures. The chart caption spells out the same distinction.

Cumulative S-curve

The probability that total impact stays at or below each x-value, for the baseline run. There's no treated overlay on the chart; compare against the treated P80 in the hero stat row.

Cost-benefit per treatment

One row per treatment: cost, marginal expected-loss reduction, and ROI as an inline pill (green at 1.0× or better, ochre below). The marginal figure comes from re-running the simulation with just that treatment removed and comparing against the fully treated run, so each row answers "given the other treatments are in place, is this one worth its cost?"

Driver sensitivity

Three lists side by side (causes, impacts, controls), each ranked by contribution to total variance, computed by re-running the baseline with that driver removed. It tells you which driver to invest treatment effort against, and which existing controls are doing the most work today.

All percentiles and key findings

Seven percentile cells (P10 / P25 / P50 / P75 / P80 / P90 / P95) for the baseline run, plus mean, standard deviation, occurrence rate, and iteration count.

Exporting

Export JSON downloads the envelope as a portable file, the same shape Event Risk reads on Import. Use it for backup, version control, or handoff. There's no PDF report for Event Risk yet; PRQ's report is the pattern one would follow.