This estimator converts an internal-access scenario into an annualized risk exposure amount. It combines the number and value of assets available to insiders with the share realistically exposed and the estimated annual chance of a harmful event. Security teams can use the result to compare privileged-access risks, prioritize monitoring, or frame a control budget.
The model is intentionally transparent: it does not claim to predict a breach. Instead, it expresses a consistent planning estimate that can be revised as access inventories, investigation findings, or loss assumptions improve.
1. Define the population
Enter the number of assets, systems, records, or services included in the scenario.
2. Set average value
Enter a consistent monetary value per item, including direct and relevant indirect impact.
3. Estimate exposure
Enter the percentage of the population that could realistically be affected.
4. Weight by likelihood
Enter the estimated annual probability of the scenario.
5. Review the breakdown
Compare gross exposure with the probability-weighted annual result.
Exposure share and incident probability are entered as percentages and converted to decimals. The model assumes a common average value across the included assets and treats annual probability as a scenario weight rather than a forecast.
The displayed value is a scenario estimate for insider misuse. Use it to compare assumptions and priorities rather than as a guaranteed outcome.
Use asset values and probabilities that reflect your environment; insider incidents vary widely in scope and intent.
Given: 240 assets, $18,000 average value, 35% exposed, and 8% annual probability.
Calculation: Gross exposure = 240 × $18,000 × 0.35 = $1,512,000. Annualized exposure = $1,512,000 × 0.08 = $120,960.
Result: The modeled annualized risk exposure is $120,960. This is a prioritization estimate, not a prediction of a specific incident.
It is the gross amount at risk multiplied by the estimated annual probability. It is useful for comparing scenarios, but it is not a guaranteed yearly loss.
Use the same valuation basis across all included items. Depending on the scenario, value may include replacement, response, business interruption, or data-impact costs.
Yes. A zero probability produces zero annualized exposure while preserving the gross exposure figure for reference.
Exposure share describes how much of the population could be affected in one scenario. Probability describes how likely that scenario is to occur during a year.
Only when a common average is reasonable. Otherwise, calculate separate groups and add their annualized exposure amounts.