Modeled risk

The CyberOptix CTEM Platform computes a set of named figures about how an attacker could move through your environment, and the Executive Risk Overview shows them under the names an executive reader expects. Every one of them is modeled: it comes from the attack paths the CyberOptix CTEM Platform built from your assessed exposures, under stated assumptions, with a stated horizon. None of them is an empirically calibrated likelihood of a breach, and no single figure is "your risk". They are kept apart on purpose, the CyberOptix CTEM Platform never combines them into one number, and this page explains each one.

If you have not read Exposures and evidence and Attack paths, the figures will still make sense, but those pages say where they come from.

What every figure shares

• Modeled, not measured. The figures are produced by a model over the evidence the platform holds. They are not calibrated against breach outcomes, so a figure of twenty percent is not a one-in-five chance of anything. Read it as a comparison between two states of your environment, or between two moments in time, under one model version.
• A horizon. Every likelihood is stated for the horizon the model version names (twelve months in the current version). The page shows the horizon beside the figures.
• A model version. Every figure carries the version of the model that produced it. Figures from different versions are not directly comparable; see Model versions.
• Confidence and coverage beside, never inside. How well evidenced the figures are, and whether the search behind them was complete, are reported next to them. Neither is applied to them: a figure is never discounted for low confidence.
• Exact or approximate, said beside. Every figure that combines several routes says whether it combined them exactly under the model's assumptions or as independent, and why. See Shared dependencies.

Modeled 12-month breach probability

The modeled likelihood that at least one entry path succeeds within the horizon: the model's Modeled 12-Month Breach Probability. An entry path starts at an exposure an attacker can reach from the internet, and every such exposure is a path of its own, priced by the evidence it carries. The paths combine as the model combines materially distinct paths, so the figure is never a sum of percentages.

An exposure whose reachability was never established is not an entry. The platform prices an unknown reachability as open when it decides what to fix first, because that is the conservative rule for prioritization; it does not model an attacker entering through it, because an entry is an exposure an attacker can reach from outside and an assumption is not evidence of that. Such an exposure stays scored, stays a step an attacker who is already inside could take (priced from inside), and is counted on the page as left out, with the reason.

So the figure moves only when an entry appears, disappears, or becomes more or less likely. Adding an internal asset does not move it. Remediating a weakness that an attacker could only reach after entering does not move it either. Every weakness reachable from the internet does move it, by exactly what the evidence curve gives it: a weakness with little evidence moves it little, and a weakness with none moves it by the floor of the curve, which the model sets at a tenth of a percent.

Beside the figure the page counts the entry paths and the internet-facing assets they stand on, and the externally reachable exposures the entry rule left out, by reason:

Reason shown	Meaning
Reachability not established	Nothing observed the exposure from the internet; it is priced open for prioritization and is not an entry
Attack vector not reachable from the internet	The weakness needs local, physical or adjacent access, which an attacker on the internet does not have

An exposed credential is an entry only once validated. A login pair the platform resolves from breach intelligence to one of your identities is a way into the organization an attacker could use from outside, so it is an entry in its own right rather than a step reached from inside. It counts only after testing, by the appliance or a person, has authenticated with it: a proven credential moves the figure, and a credential not yet validated stays a visible finding, is counted among the exposures the entry rule left out, and is never priced into the figure. Where no entry of any origin is established the figure reads as insufficient data.

Overlapping entries are combined as distinct paths. Several weaknesses on one internet-facing asset are several entry paths onto the same asset. The model calls for a correlation adjustment between highly overlapping paths before they are combined and leaves its definition to calibration, so none is applied; the page names that among the assumptions and shows the entry paths beside the assets so the overlap is visible. A step several paths share counts once.

What the figure can be under dependence between paths. The figure assumes the entry paths succeed independently of one another, because the model represents no dependence between distinct weaknesses. Beside it the page says what the figure can be if they do depend on one another, given the model's own path probabilities: it can be no lower than the strongest single entry path, under any dependence whatever, and no higher than the paths' probabilities added together and capped at one, under any dependence whatever. Where no two entry paths rest on one weakness, the figure itself is the highest value positive dependence allows, so dependence can only lower it within that range. The range is the arithmetic of the paths found under the model's probabilities; it is not a statistical confidence interval and not a range of your actual exposure, and where the search was cut only its lower end is stated, since a path the search did not find would add to the figure. It is shown apart from confidence, which says how well evidenced the paths are, and from coverage, which says whether the search was complete.

Where no exposure meets the entry rule the page shows insufficient data in place of the figure, with what was left out and why, rather than a zero: a zero would be a statement about your estate, and the absence of eligible entries is a statement about the evidence. Establishing reachability models one. The two states the figure can be in are "Modeled" and "Insufficient data", and the page says which.

It is not the organization's overall risk, which also depends on what a breach would reach and what that would cost, and it says nothing about what an intruder could reach after entering. For that, read the next three figures.

Modeled lateral reach

The modeled likelihood that at least one step beyond an entry succeeds within the horizon, read from the same paths as the entry figure. It rises when a new lateral step opens, falls when one closes, and stays where it is when only the entries change.

Beside the figure the page counts what the paths reached:

Count	Meaning
Assets entered on	Distinct assets an entry step lands on
Assets reached beyond an entry	Distinct assets a later step lands on
Network positions gained	Zones an attacker holds after some step, beyond the starting position
Principals gained	Accounts or roles an attacker holds after some step
Expected compromised assets	The modeled likelihood of each asset being reached, added up across assets

Reached means a modeled compromise on a path, not merely that an asset answers on the network. A step is on a path only where an exposure on that asset could be exploited from a position the attacker already holds.

The counts treat every asset, position and principal alike. They say how far the paths go, not how much any of it matters to the business. Importance lives with crown jewels.

Depth and privilege

How far the paths go, and what each step yields:

• Deepest path in steps, and how many reached states sit at each depth.
• Level yielded on each state, kept apart by basis. A step whose exploitation a tester or an automated validation demonstrated yields the level that validation showed, up to root level. A step the model only assumes yields user level. The model never escalates privilege on its own, so a root-level state on this page is always one somebody demonstrated.
• Privilege checks. Where an exposure needs elevated privileges, the step is confirmed only when a relationship the platform knows names an account the attacker holds on that resource. Otherwise the step is counted as unknown and the model discounts it. Reaching an asset does not grant privileges on it.

Crown jewel exposure

The crown jewels you designated, and what the paths established about them: how many any path reaches, how many are reached on the demonstrated rung, how many carry financial inputs, and the modeled likelihood that any crown jewel is compromised. The same counts are grouped by the business criticality you gave each jewel.

Criticality is yours and is never turned into a weight; a critical jewel does not multiply any figure. The platform's own reading of how a jewel is reached is kept separately as technical importance. Crown jewels and business impact has the details.

Modeled financial exposure

The modeled compromise of each crown jewel, multiplied by the consequences you stated for it, in your numbers and your currency. The organization figure adds the jewels' figures and counts response and recovery once per modeled incident.

Where no numbers were given the figure is absent, shown as insufficient data, never zero. Where jewels were valued in mixed currencies the figure is absent and says so; nothing is converted. It is not a guaranteed loss and not an actuarial forecast: it is the model's likelihood applied to your own estimate.

Demonstrated exploitation

What a tester or an automated validation proved, kept apart from the model:

• paths whose every step was demonstrated;
• paths with at least one demonstrated step;
• entries that were demonstrated;
• the modeled figure over the fully demonstrated paths only.

The last of these is still the model's figure, restricted to proven paths. It is not a likelihood that what was demonstrated will happen again.

Confidence and coverage

Confidence is how well evidenced the exposures on the paths are: whether the evidence inputs were measured or missing, how fresh the latest observation is, whether validation was attempted, and whether the asset's position in the network is known. The page shows the mean across paths, weighted by each path's likelihood, and the minimum. Confidence qualifies the figures and is applied to none of them: a poorly evidenced exposure keeps its figure and is flagged, rather than quietly discounted.

Coverage says whether the search that built the paths was complete:

Reason shown	Meaning
Build truncated	The search hit one of its bounds (branching, depth, paths per entry, or an entry's evaluation allowance)
Exposures without assessment	Some live exposures had not been assessed yet, so they are not on any path
Assets without position	Some assets carrying exposures sit in no zone and no relationship reaches them
No public zone	No zone is marked as the internet-facing boundary, so no internet entries exist
Entries not expanded	Not every entry was explored

When coverage is incomplete the figures are over the paths that were found and nothing more. Incomplete coverage does not establish a bound: it is not the case that the true figure is at least, or at most, what is shown.

Shared dependencies and how routes are combined

A figure such as lateral reach or a crown jewel's compromise is the likelihood that at least one of the routes into its target succeeds. Routes share things: two routes from different entries can run through the same internal weakness, and two branches from one entry can reach the same weakness by different prefixes. The model treats each weakness as one thing that either can or cannot be exploited, wherever it appears, so a weakness two routes share counts once. Within one entry, a path and its continuation are one chain and are never counted twice.

Each figure says how its routes were combined:

Label	Meaning
Exact under the model's assumptions	The routes were combined exactly, with every shared weakness counted once
Combined as independent	The routes, or one tangled set of them, were combined as if they shared nothing, which counts a shared weakness once per route and can only put the figure above the exact one
Partly combined as independent	Some figures on the snapshot were combined exactly and some as independent

The exact combination has a cost that grows with how tangled the routes are, so every calculation runs under a budget. When the budget runs out on a set of routes, that set alone is combined as independent, the figure says so and why, and the rest of the figure stays exact. Where that happens with complete coverage, the figure also shows the range it lies in, as "between X and Y under the model's assumptions, over the paths found". That range holds under the model's assumptions and for the routes the search found; it is never a range of your actual exposure, and a figure from a cut search shows no range at all, because incomplete coverage establishes nothing in either direction.

Two things keep their earlier reading: a sum of figures (expected compromised assets, the organization's financial figure) carries the weakest label among its terms, and a difference of two figures (a domain's marginal contribution, every projected change) carries their labels and never a range. The page still lists the dependencies that several entries share, so you can see where the routes are tangled.

Model versions and history

Every figure carries the version of the model that produced it, and the History panel breaks its line wherever the version changes. Figures produced under different versions are not directly comparable, so a step in the line at a version change is a change in the model, not a change in your security posture.

Three corrections stand behind the current version. The first changed how paths are counted: every asset an attacker reaches is its own outcome on its own path, where the earliest version counted only the end of each chain, and under it the entry figure could fall as paths grew longer. The second changed how routes are combined: a weakness several routes share now counts once, where the previous version combined routes as independent and could put a figure above its exact value. The third changed what counts as an entry: an exposure whose reachability was never established is no longer an entry, where earlier versions admitted every externally reachable exposure, assumed or not, as an entry, so that an estate with tens of thousands of such exposures read a near-certain figure built from assumptions. No formula changed in the third correction. Each correction makes the figures move in the direction the environment moved: removing a weakness never raises a figure, and adding one never lowers it. Figures from before a correction are shown as history and should not be compared with figures after it; a step at the version change is a change in the model, not a change in your security posture, and under the third correction that step is downward by exactly the entries that were assumptions.

Reading the figures together

• Breach probability answers "how likely is it that someone gets in". Lateral reach, depth and privilege answer "and then what". Crown jewels and financial exposure answer "does it reach what matters, and what would that cost". Demonstrated exploitation answers "how much of this has actually been shown". Confidence and coverage answer "how much should I trust the rest".
• A remediation that leaves the entry figure where it is and moves the lateral or crown-jewel figures is a real change. The Risk Posture page ranks remediation options by whichever figure you choose, so that change is visible.
• Severity, SSVC priority and SLAs still decide the order of work in Findings. These figures sit beside them; they do not replace them.

Next

• Exposures and evidence - where the likelihoods come from
• Attack paths - how the paths are built
• Risk Posture - the page that shows all of this