Scenario
Initial gut reaction (optional)
Record your quick estimate before the structured steps.
Scenario Brief
Review the data below before starting your structured forecast (~2 min read).
Step 1: Base Rate
Start with what typically happens before you adjust.
Required field
Step 2: Distinguishing Details
Identify what moves risk up or down from the base rate.
Required field
Step 3: Reference Class
Compare to similar situations.
Required field
Step 4: Final Adjustment
Set your final probability and explain your reasoning.
Required field
Results
Review your path and refine if needed.
Final probability
Gut reaction
Base rate
Reference class
Adjustment
Use this in the LEC Builder
Run this exercise twice to populate the LEC inputs:
- Run 1: Forecast probability before controls. Use that as Outside-In.
- Run 2: Forecast how much controls reduce probability. Use that as Inside-Out reduction.
Your current final estimate can be used as Outside-In for Run 1.
Forecasting journey
Chart summary updates as you enter estimates.
Reference comparison
Chart summary updates after you enter a final estimate.
Structured forecasts beat gut reactions because they force explicit assumptions.
Learning Debrief
What You Just Learned
- Anchor with base rates before adjusting for details.
- Use reference classes to avoid overconfidence.
- State your final probability clearly and defend the path to it.
- Document how each step changed your estimate.
Applying This to Cyber Risk
Use structured forecasts to explain risk without relying on gut feel.
Material Breach Probability
Combine industry base rates with your controls and exposure to land on a defensible annual probability.
Vulnerability Exploitation Window
Start with a public exploit rate, then adjust for internet exposure, patch cadence, and adversary interest.