Risk P&L

Decision Maker	Delegation Limit	Total Accepted	Exceedance	Status	Risks	Note
Marcus Hoffmann ▾ CISO	€3.0M	€23.2M	+€20.2M	EXCEEDS LIMIT	R-001 R-003 R-004 R-007 R-009 R-012	R-001 and R-012 co-accepted with CRO
Accepted Risks Detail — Marcus Hoffmann R-001 Ransomware (data encryption) Residual A$9.1M exceeds CISO limit — co-accepted with CRO. EDR + backup isolation reduce inherent A$18.2M by 50%. Board notified. DE.AE RS.ANVaR: A$18.2MResidual: €9.1MTreatment: mitigateCo-accepted with Dr. Julia Braun Agents: soc, ir Accepted: 2026-01-15 Review: 2026-07-15 R-003 Insider data exfiltration Insider exfiltration residual A$1.8M within CISO limit. DLP + UEBA + access reviews provide adequate controls. Risk accepted within appetite. PR.AC DE.CMVaR: A$4.8MResidual: €1.8MTreatment: accept Agents: iam, privacy Accepted: 2026-02-01 Review: 2026-08-01 R-004 Cloud misconfiguration breach Cloud misconfiguration residual A$3.2M within CISO limit. Wiz CSPM + Prisma Cloud active. 15 unintended internet-facing resources require remediation. PR.DS ID.AMVaR: A$6.2MResidual: €3.2MTreatment: mitigate Agents: secarch, vuln Accepted: 2026-01-20 Review: 2026-07-20 R-007 AI model poisoning / prompt injection AI model poisoning residual A$1.7M within CISO limit. OneTrust AI governance framework at 38% effectiveness. Conformity assessments planned Q2. GV.RM ID.RAVaR: A$2.8MResidual: €1.7MTreatment: accept Agents: aigov, appsec Accepted: 2026-02-15 Review: 2026-08-15 R-009 Phishing leading to BEC Phishing/BEC residual A$3.4M within CISO limit. KnowBe4 awareness program active but Finance department at 28% click rate requires targeted intervention. PR.AT DE.AEVaR: A$5.6MResidual: €3.4MTreatment: mitigate Agents: awareness, soc Accepted: 2026-01-25 Review: 2026-07-25 R-012 Privacy Act data subject rights breach Privacy Act breach residual A$4.0M at CISO limit ceiling. 3 non-prod environments with real PII require immediate remediation. DPIA backlog creates exposure. GV.OC PR.DSVaR: A$8.4MResidual: €4.0MTreatment: mitigateCo-accepted with Dr. Julia Braun Agents: privacy, compliance Accepted: 2026-01-30 Review: 2026-07-30
Dr. Julia Braun ▾ CRO	€5.0M	€14.0M	+€9.0M	EXCEEDS LIMIT	R-002 R-005	R-005 escalated to board (SOCI Act Art. 20 liability)
Accepted Risks Detail — Dr. Julia Braun R-002 Supply chain compromise Supply chain residual A$7.2M within CRO limit but exceeds CISO limit. Vendor monitoring + SBOM analysis active. Insurance overlay covers A$2M. GV.SC ID.SCVaR: A$12.4MResidual: €7.2MTreatment: mitigate Agents: vendorrisk, appsec Accepted: 2025-12-20 Review: 2026-06-20 R-005 Regulatory non-compliance (SOCI Act) SOCI Act non-compliance residual A$6.8M exceeds CISO limit. 3 compliance gaps active. ACSC registration deadline March 2026. Board personally liable under Art. 20. GV.OC GV.RMVaR: A$10.0MResidual: €6.8MTreatment: mitigate Agents: compliance, grc Accepted: 2025-12-15 Review: 2026-06-15
Dr. Stefan Weber ▾ Dept Head	€500K	€800K	+€300K	EXCEEDS LIMIT	R-006	Credential stuffing — compensating controls documented
Accepted Risks Detail — Dr. Stefan Weber R-006 Credential stuffing / account takeover Credential stuffing residual A$800K within department head limit. MFA at 96% coverage. Remaining 4% are service accounts with compensating controls. PR.AA DE.AEVaR: A$3.1MResidual: €800KTreatment: accept Agents: iam, soc Accepted: 2026-02-10 Review: 2026-08-10
Thomas Meier ▾ Dept Head	€500K	€1.2M	+€700K	EXCEEDS LIMIT	R-008 R-011	R-008 transferred via insurance (A$600K)
Accepted Risks Detail — Thomas Meier R-008 Third-party SaaS outage SaaS outage residual A$1.0M transferred via cyber insurance (A$600K) and vendor SLA credits (A$400K). Within department head limit. ID.SC RC.RPVaR: A$1.9MResidual: €1.0MTreatment: transfer Agents: vendorrisk Accepted: 2026-01-10 Review: 2026-07-10 R-011 DDoS on customer-facing services DDoS residual A$200K within department head limit. Cloudflare + Palo Alto DDoS protection at 91% effectiveness. Acceptable residual. DE.AE RS.MIVaR: A$2.1MResidual: €200KTreatment: accept Agents: secarch, soc Accepted: 2026-02-05 Review: 2026-08-05
UNSIGNED ▾ No authorized acceptor	—	€5.4M	€5.4M	GOVERNANCE FAILURE	R-010	47 days without acceptor
Governance Failure — Unpatched critical CVE exploitation Unpatched CVE residual A$5.4M — UNSIGNED. Exceeds CISO A$3M limit, not yet accepted by CRO. CVE-2024-3400 on internet-facing firewall is active exploitation. GOVERNANCE FAILURE: 47 days without authorized acceptor. VaR: A$8.7MOwner: CISOESCALATION REQUIRED Agents: vuln, secarch

Board Risk Appetite: €15.0M

Total ARE: €19.6M (131% of appetite)

Unsigned: €8.5M above appetite with no acceptor

▾

Exhibit 3

Evidence-Based Risk Adjustment

Click any row for full finding detail — 17 vendor tools feed into risk calculations

Static ALE

€3.6M

→

Evidence-Based ALE

€9.4M

Uplift

+161%

Risk	Source	Finding	Static ALE	Adjusted ALE	Change	Confidence	Decay
R-001	CrowdStrike Falcon ▾	Active Cobalt Strike beacon on WS-0847 (watermark 1359593325, Lockbit affiliate)	€5.1M	€6.4M	+25%	HIGH	30d
Full finding: Active Cobalt Strike beacon on WS-0847 (watermark 1359593325, Lockbit affiliate) Risk: Ransomware (data encryption)VaR: A$18.2MAdjustment factor: +25%Timestamp: 2026-03-09T06:12ZIOC: 185.220.101[.]42 Agents: soc, ir
R-001	Recorded Future ▾	Lockbit 4.0 targeting DACH manufacturing sector — 3 confirmed hits this quarter	€5.1M	€7.3M	+44%	HIGH	60d
Full finding: Lockbit 4.0 targeting DACH manufacturing sector — 3 confirmed hits this quarter Risk: Ransomware (data encryption)VaR: A$18.2MAdjustment factor: +15%Timestamp: 2026-03-08T14:00Z Agents: soc, ir
R-010	Tenable VPR ▾	CVE-2024-3400 (PAN-OS) VPR 10.0 — active exploitation, CISA KEV listed, on inter...	€3.5M	€4.9M	+40%	HIGH	7d
Full finding: CVE-2024-3400 (PAN-OS) VPR 10.0 — active exploitation, CISA KEV listed, on internet-facing FW-EDGE-01 Risk: Unpatched critical CVE exploitationVaR: A$8.7MAdjustment factor: +40%Timestamp: 2026-03-09T08:00Z Agents: vuln, secarch
R-004	Wiz ▾	15 resources unintentionally internet-reachable including 4 RDS with 0.0.0.0/0 s...	€2.5M	€3.0M	+20%	MEDIUM	14d
Full finding: 15 resources unintentionally internet-reachable including 4 RDS with 0.0.0.0/0 security groups Risk: Cloud misconfiguration breachVaR: A$6.2MAdjustment factor: +20%Timestamp: 2026-03-07T18:00Z Agents: secarch, vuln
R-004	Snyk ▾	6 critical dependency vulnerabilities in production containers (axios CVE-2024-3...	€2.5M	€3.2M	+30%	MEDIUM	14d
Full finding: 6 critical dependency vulnerabilities in production containers (axios CVE-2024-39338, 18 days unpatched) Risk: Cloud misconfiguration breachVaR: A$6.2MAdjustment factor: +10%Timestamp: 2026-03-08T10:00Z Agents: secarch, vuln
R-009	KnowBe4 ▾	Finance department 28% phish click rate (3x org average), 3 users submitted cred...	€2.8M	€3.6M	+30%	HIGH	30d
Full finding: Finance department 28% phish click rate (3x org average), 3 users submitted credentials, 3 attempted wire transfers Risk: Phishing leading to BECVaR: A$5.6MAdjustment factor: +30%Timestamp: 2026-03-06T09:00Z Agents: awareness, soc
R-002	SecurityScorecard ▾	3 critical vendors scored below 65 (CriticalVendor-A: 58, CriticalVendor-B: 62, ...	€1.5M	€1.8M	+20%	MEDIUM	30d
Full finding: 3 critical vendors scored below 65 (CriticalVendor-A: 58, CriticalVendor-B: 62, CriticalVendor-C: 64) Risk: Supply chain compromiseVaR: A$12.4MAdjustment factor: +20%Timestamp: 2026-03-09T02:00Z Agents: vendorrisk, appsec
R-005	OneTrust GRC ▾	SOCI Act implementing act (EU 2025/2256) — 14 new technical measures, 3 gaps ide...	€3.0M	€4.0M	+35%	HIGH	90d
Full finding: SOCI Act implementing act (EU 2025/2256) — 14 new technical measures, 3 gaps identified. ACSC registration deadline T-0 days Risk: Regulatory non-compliance (SOCI Act)VaR: A$10.0MAdjustment factor: +35%Timestamp: 2026-03-09T02:00Z Agents: compliance, grc

Methodology: FAIR 3.0 (Open Group, Jan 2025) — LEF × LM with Monte Carlo simulation. Click for detail. ▾

Exhibit 4

Delegation Authority Matrix

Click any tier to see accepted risks and co-acceptance rules

Board ▾

€15.0M

Board of Directors (Supervisory Board)

CRO ▾

€5.0M

Dr. Julia Braun (Chief Risk Officer)

CFO ▾

€5.0M

Klaus Schneider (Chief Financial Officer)

CISO ▾

€3.0M

Marcus Hoffmann (Chief Information Security Officer)

Department Head ▾

€500K

Dr. Stefan Weber (Head of Engineering), Anna Richter (Head of Finance), Thomas Meier (Head of Operations)

Co-Acceptance Rule ▾

When residual risk exceeds an individual's limit but falls within the next tier, dual sign-off is required.

SOCI Act Art. 20 — Personal Liability ▾

Management bodies "can be held liable for infringements."

Exhibit 5

Attack Path Analysis

Click any path to expand kill chain steps and intelligence detail

AP-001 ▾

Max Impact

€46.6M

CVE-2024-3400 → FW-EDGE-01 → internal network → DC-02 → domain admin

Probability:

40%ALE:€2.8M

AP-002 ▾

Max Impact

€5.6M

Phishing (Finance) → credential harvest → BEC wire transfer → A$2.1M loss

Probability:

35%ALE:€2.0M

AP-003 ▾

Max Impact

€18.2M

Cobalt Strike beacon → lateral movement → ransomware deployment → full encryption

Probability:

28%ALE:€5.1M

Exhibit 6

Investment Decision Frame

Click any initiative for risk detail, timeline, and payback period

Total Investment

€840K

Risk Reduction

€12.0M

Overall ROI

14.3x

#	Initiative	Cost	Risk Reduction	ROI	Status
1	Cloud-native IR playbooks ▾	€180K	€3.2M	17.8x	IN PROGRESS
R-001 Ransomware (data encryption)R-004 Cloud misconfiguration breach Timeline: 60 daysNet benefit: €3.0MPayback: < 1 months
2	Continuous compliance automation ▾	€240K	€2.8M	11.7x	PLANNED
R-005 Regulatory non-compliance (SOCI Act)R-012 Privacy Act data subject rights breach Timeline: 90 daysNet benefit: €2.6MPayback: < 2 months
3	Vendor continuous monitoring ▾	€120K	€1.9M	15.8x	IN PROGRESS
R-002 Supply chain compromise R-008 Third-party SaaS outage Timeline: 45 daysNet benefit: €1.8MPayback: < 1 months
4	Patch SLA acceleration (14d) ▾	€90K	€1.6M	17.8x	PLANNED
R-010 Unpatched critical CVE exploitation Timeline: 30 daysNet benefit: €1.5MPayback: < 1 months
5	Security awareness refresh ▾	€60K	€1.1M	18.3x	PLANNED
R-009 Phishing leading to BEC Timeline: 30 daysNet benefit: €1.0MPayback: < 1 months
6	AI governance conformity ▾	€150K	€1.4M	9.3x	PLANNED
R-007 AI model poisoning / prompt injection Timeline: 120 daysNet benefit: €1.3MPayback: < 2 months

BCG Cyber Doppler: ROI = [(Expected Losses Before) - (Expected Losses After) - (Project Cost)] / Project Cost. Risk-based prioritization delivers €9.0M savings vs maturity-based approach.

Exhibit 7

Quarterly TARE Trajectory

McKinsey "altitude + trajectory" — the board sees direction, not just a snapshot

Overall Trend

-31%

Target

€12.0M

€28.4M

Q3 2025

€23.8M

Q4 2025

€19.6M

Q1 2026

€14.2M

Q2 2026

€12.0M

Q4 2026

Quarter	TARE	Above Appetite	Unsigned	Trend	Note
Q3 2025	€28.4M	7	€12.1M	—	Baseline — first measurement
Q4 2025	€23.8M	5	€9.2M	-16%	IR playbooks + vendor monitoring launched
Q1 2026 NOW	€19.6M	4	€5.4M	-18%	Current — 3 risks re-accepted after controls
Q2 2026 (proj)	€14.2M	2	€2.1M	-28%	Patch SLA + awareness expected to land
Q4 2026 (target)	€12.0M	0	€0	-15%	All 6 initiatives complete

McKinsey: "A single snapshot is insufficient." The board needs altitude (where we are) and trajectory (where we're headed). TARE trending down demonstrates program effectiveness — even if the absolute number hasn't yet reached appetite.

Exhibit 8

Insurance Transfer Overlay

Click cards for detail — coverage gap analysis and optimization

Current Policy ▾

Allianz Cyber

Annual Premium€285K

Policy Limit€5.0M

Deductible€250K

Coverage Gap ▾

€33.6M

Residual risk minus insurance limit

Recommended Coverage ▾

€15.0M

Est. premium: €520K/year

Exhibit 9

Regulatory Penalty Exposure

Click any regulation for article detail and enforcement context

NIS2 ▾

PERSONAL LIABILITY

€10.0M

2% of global turnover or A$10M (Art. 34(4))

SOCI Act Art. 20

DORA ▾

PERSONAL LIABILITY

Variable

2% of global turnover (Art. 50)

CPS 234 Art. 5

GDPR ▾

€20.0M

4% of global turnover or A$20M (Art. 83(5))

Privacy Act Art. 83

Exhibit 10

Board Presentation Script

60-second CISO script — ready to present. Copy and adapt to your numbers.

YOUR 60-SECOND BOARD SCRIPT

"Three numbers for the board today:

First: We carry €19.6M in accepted cyber risk — down 18% from last quarter. The trend is positive.

Second: €8.5M sits above the risk appetite you approved. Under SOCI Act Article 20, this cannot remain unsigned. It requires a board resolution with individual signatures.

Third: Expected annual loss is €9.4M — this includes live tool evidence that increases static estimates by 161%.

I need one decision today: approve €840K for six targeted initiatives. This delivers a 14.3x ROI, drops the exceedance to under €1M within 120 days.

The alternative: I need each of you to formally accept €8.5M in excess risk — individually signed — for our SOCI Act Article 20 compliance file."

Format

One slide. Three numbers. The script takes exactly 60 seconds. Practice it.

McKinsey Principle

"Report risks and threats, not technology capabilities." No technical jargon. Only EUR and decisions.

The Close

Always end with a binary choice: approve the investment, or sign the risk. Board members choose action.

Exhibit 11

Sources & References

All frameworks, data points, and regulatory references with publication URLs

MCK-01

McKinsey — Competitive Advantage Through Cybersecurity (Aug 2025)

https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/competitive-advantage-through-cybersecurity-a-board-level-perspective

MCK-02

McKinsey — Global Risk Productivity Survey (Feb 2026)

https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/global-risk-productivity-survey-four-themes-shaping-risk-management

MCK-03

McKinsey — The Future of Risk (Dec 2025)

https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/the-future-of-risk-how-global-trends-are-reshaping-risk-management

BCG-01

BCG Platinion — Cyber Doppler ROI Methodology (2024)

https://www.bcg.com/capabilities/digital-technology-data/cybersecurity

BCG-02

BCG — AI Is Raising the Stakes in Cybersecurity (Dec 2025)

https://www.bcg.com/publications/2025/ai-raising-stakes-cybersecurity

FAIR-01

FAIR Standard v3.0 (Open Group) (Jan 2025)

https://www.fairinstitute.org/what-is-fair

SOCI Act-01

SOCI Act Directive (EU) 2022/2555 — Art. 20, 21, 34 (Dec 2022)

https://eur-lex.europa.eu/eli/dir/2022/2555

CPS 234-01

CPS 234 Regulation (EU) 2022/2554 — Art. 5 (Dec 2022)

https://eur-lex.europa.eu/eli/reg/2022/2554

BAIN-01

Bain — Most Companies Overestimate Their Cybersecurity (2024)

https://www.bain.com/insights/cybersecurity-is-critical-to-digital-trust

GART-01

Gartner — CARE Framework for Cybersecurity (2024)

https://www.gartner.com/en/documents/3980890

DB-01

Diligent/Bitsight — Cybersecurity & TSR Correlation (3.7x) (Mar 2024)

https://www.diligent.com/resources/blog/cybersecurity-shareholder-returns

Want this for your organization?