Cyber Risk Trend Calculator

monthlyRate = (currentScore − previousScore) ÷ periodMonths; monthsToTarget = (currentScore − targetScore) ÷ |monthlyRate| when the rate is negative. A single risk score is nearly meaningless; the direction and the rate are what tell you whether the programme is working. Comparing both to the previous period and to a year ago separates genuine improvement from seasonal noise, and the register burn-down is tracked independently because a falling score with a growing register usually means risks are being accepted rather than fixed.

Boards fund trajectory, not position — a 62 that has fallen twelve points in a year is a well-run programme, and a 62 that has been 62 for three years is a stalled one.

This calculator takes 8 inputs: Current risk score, Score one period ago, Score a year ago, Length of one period, Target risk score, New risks accepted per period, Risks remediated per period, Open risks on the register. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because quarterly movement is noisy — an audit, a new tool or a reclassification can move the score several points without anything real changing. The year-on-year figure is what confirms a trend.

That is the classic warning sign that risks are being accepted rather than remediated, or that scoring is drifting. Trust the register burn-down over the score when the two disagree.