Domain 13 · Executive, Board, and Capital-Allocation Intelligence
Cyber Capital Allocation and Decision Compression
Compress technical exposure into a board-legible decision: which portfolio of interventions gives the highest modelled marginal risk reduction under a stated budget.
Decision it answers
Where should the next tranche of security budget go, and what do we get for it?
Inputs it needs
- Prioritised exposure register
- Intervention costs and delivery constraints
- Stated risk appetite and tolerances
- Business consequence mapping
Methods applied
- Marginal risk-reduction estimation per intervention
- Portfolio comparison under budget constraints
- Security, cost and usability frontier construction
- Risk-to-control traceability from board statement down to evidence
Outputs produced
- Ranked intervention portfolio
- Modelled risk reduction with formula and assumptions published
- Traceability map from board risk to technical evidence
- Residual-risk statement
Must remain human-owned
Authorization, acceptance of residual risk, containment decisions, disclosure and notification, and any communication to a board or regulator. No analytical capability creates operational authority.