This estimator expresses third-party risk as an annualized exposure amount. It multiplies the count and average value of dependent assets or services by the share exposed to the third party, then weights that gross exposure by an annual incident probability.
The calculation provides a comparable planning figure for supplier reviews and concentration-risk discussions. It does not replace a full assessment of control maturity, contractual liability, data sensitivity, or systemic dependencies.
1. Define the population
Enter the number of assets, systems, records, or services included in the scenario.
2. Set average value
Enter a consistent monetary value per item, including direct and relevant indirect impact.
3. Estimate exposure
Enter the percentage of the population that could realistically be affected.
4. Weight by likelihood
Enter the estimated annual probability of the scenario.
5. Review the breakdown
Compare gross exposure with the probability-weighted annual result.
Exposure share and incident probability are entered as percentages and converted to decimals. The model assumes a common average value across the included assets and treats annual probability as a scenario weight rather than a forecast.
The displayed value is a scenario estimate for third-party access and dependency. Use it to compare assumptions and priorities rather than as a guaranteed outcome.
Define an “asset” consistently—such as a system, dataset, process, or contract—before comparing vendors.
Given: 60 assets, $75,000 average value, 50% exposed, and 12% annual probability.
Calculation: Gross exposure = 60 × $75,000 × 0.50 = $2,250,000. Annualized exposure = $2,250,000 × 0.12 = $270,000.
Result: The modeled annualized risk exposure is $270,000. This is a prioritization estimate, not a prediction of a specific incident.
It is the gross amount at risk multiplied by the estimated annual probability. It is useful for comparing scenarios, but it is not a guaranteed yearly loss.
Use the same valuation basis across all included items. Depending on the scenario, value may include replacement, response, business interruption, or data-impact costs.
Yes. A zero probability produces zero annualized exposure while preserving the gross exposure figure for reference.
Exposure share describes how much of the population could be affected in one scenario. Probability describes how likely that scenario is to occur during a year.
Only when a common average is reasonable. Otherwise, calculate separate groups and add their annualized exposure amounts.