How “Valuation at Risk” is calculated

What the number is

A conditional figure: if this company suffers a disclosed material breach, the share of its value that comparable listed companies lost, applied to the valuation entered for it, which RiskPoint treats as its enterprise value. It is shown as a range, not a single point, and that range also spans the ± tolerance on the valuation. Each company's range stands alone: it is never added across a portfolio.

What it is not

• Not a certain annual loss (“your cyber cost is £N”).
• Not weighted by a breach probability: we never invent one. A fund that wants a probability-weighted figure can enter its own on the company, and it is shown beside the range, labelled as the fund's.
• Not a value per finding or per fix: a fix lowers the exposure, not this consequence.
• Not a permanent-loss claim — it is a short-window market repricing (see the limits below).
• Not an audited or actuarially signed-off valuation.

How it is built

VaR = repricing anchor × valuation × data sensitivity × exposure tilt × analyst overlay

1. An AI reads the findings and names the most likely incident type and whether personal or financial data is reachable. Everything after that, the £ included, is code.
2. Repricing anchor (measured): the average share-price fall of listed companies after a disclosed breach of that type, at that company size. It comes from our event study of 110 disclosed breaches (102 measurable), where the fall averages about −2.7% of market value (p≈0.0008), robust to clustering, calendar-time and sector-matched controls. The engine uses a frozen table of 100 of those events (two confounded ones excluded), weighted toward recent ones, with a global average of 2.77% (confidence interval 1.29%–4.25%). An incident type with no measured cell of its own borrows the nearest one, with a band 1.5× wider, or falls back to the global average.
3. Data sensitivity (literature): ×2 when personal or financial data is reachable — except on a data-breach anchor, which already carries it — otherwise ×1.
4. Exposure tilt (observed): the weakest scan score and the worst finding move the figure between ×0.85 and ×1.20 (−15% / +20%): a bounded nudge, never an invented magnitude.
5. Analyst overlay (disclosed): the PE-calibration sliders re-weight the result between ×0.75 and ×1.35, shown as its own line with the measured figure kept beside it.

Where a mid-market company starts

For a company valued under $2bn, small and micro companies share one pooled cell. Before the tilt and the overlay, its share of value at risk is:

That is 5 possible starting points, 2.77% to 6.55%. The scans then move the figure by −15% / +20% at most, so across a portfolio the £ follows each company's size and incident type more than its scan results.

Every figure is labelled by where it came from

Separately, a figure’s confidence is marked MEASURED (a well-populated comparable cell) or EXPLORATORY (a small sample, a borrowed cell or the global average — read it as a wide band).

Model-risk disclosures

• The market reaction is a short-window repricing (≈53-day recovery, ≈3% six-month drift) — not proven permanent destruction; about 30% of corpus events had a positive reaction.
• The corpus is small and self-selected — skewed toward large US public firms and severe, well-known incidents (an upward severity bias).
• The anchor is a listed company's share-price reaction, applied unchanged to a private company's enterprise value. No adjustment is made for being private or for leverage.
• Cells are by incident type and company size, not industry: the sample cannot separate industries, and thin cells shrink toward the global average.
• The incident type comes from an AI reading the findings. It picks the anchor, so a different reading moves the figure between the starting points above.
• There is no per-event predictive skill — the aggregate effect is real, but a single company’s outcome is not forecastable. That is why we show a band, never a confident point.