First Principles
Risk Forecasting

A white cue ball is hidden somewhere on a billiards table. Where is it? You'll click to guess, then gather evidence (red balls land left, blue balls land right). Each new ball updates your belief. This is Bayesian reasoning.

Watch your forecasts improve with evidence. Then apply this exact logic to cybersecurity: what's the real probability a threat intel alert means you're compromised?

How many piano tuners work in Chicago? You don't know. But you can figure it out. Population times piano ownership times tuning frequency divided by tuners per year. That's Fermi estimation.

Now apply it: How many ransomware gangs actively target healthcare? Break the unknown into knowable parts. Get within 1-2 orders of magnitude. That's good enough to be useful.

"What's the probability we'll experience a material breach in the next 12 months?" Your gut says 30%. But your gut is calibrated on Hollywood movies, not data.

Forecasters use structure: start with base rates, identify distinguishing details, find reference classes, then adjust. You'll apply a four-step method drawn from academic forecasting research to cyber risk. Watch how different it is from your initial guess.

This is why you learned the other three methods. You've estimated probabilities (Bayes), quantified unknowns (Fermi), and made calibrated forecasts (Applied Forecasting). Now run 10,000 simulations.

Build your first Loss Exceedance CurveA curve that shows the chance losses exceed a given dollar amount. using Monte Carlo simulationRunning thousands of random scenarios to estimate a distribution. in Excel. See what losses you can expect at 10th, 50th, and 90th percentilesThe value below which a given percentage of outcomes fall.. This is your working risk model.