Track cyber risk direction over time: period-on-period change, run rate, projected score and time to reach a target.
A single risk score is nearly meaningless; the direction and the rate are what tell you whether the programme is working. Comparing both to the previous period and to a year ago separates genuine improvement from seasonal noise, and the register burn-down is tracked independently because a falling score with a growing register usually means risks are being accepted rather than fixed. Boards fund trajectory, not position — a 62 that has fallen twelve points in a year is a well-run programme, and a 62 that has been 62 for three years is a stalled one.
Cyber Risk Trend
monthlyRate = (currentScore − previousScore) ÷ periodMonths; monthsToTarget = (currentScore − targetScore) ÷ |monthlyRate| when the rate is negative.
Register burn-down
registerMonths = openRisks × periodMonths ÷ (closed − new) — an infinite figure means the register is growing, whatever the score says.
monthlyRate = (currentScore − previousScore) ÷ periodMonths; monthsToTarget = (currentScore − targetScore) ÷ |monthlyRate| when the rate is negative. A single risk score is nearly meaningless; the direction and the rate are what tell you whether the programme is working. Comparing both to the previous period and to a year ago separates genuine improvement from seasonal noise, and the register burn-down is tracked independently because a falling score with a growing register usually means risks are being accepted rather than fixed.
Boards fund trajectory, not position — a 62 that has fallen twelve points in a year is a well-run programme, and a 62 that has been 62 for three years is a stalled one.
This calculator takes 8 inputs: Current risk score, Score one period ago, Score a year ago, Length of one period, Target risk score, New risks accepted per period, Risks remediated per period, Open risks on the register. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because quarterly movement is noisy — an audit, a new tool or a reclassification can move the score several points without anything real changing. The year-on-year figure is what confirms a trend.
That is the classic warning sign that risks are being accepted rather than remediated, or that scoring is drifting. Trust the register burn-down over the score when the two disagree.