Skip to content
ENExplore Calculators

Cyber Risk Trend Calculator

Track cyber risk direction over time: period-on-period change, run rate, projected score and time to reach a target.

About Cyber Risk Trend Calculator

A single risk score is nearly meaningless; the direction and the rate are what tell you whether the programme is working. Comparing both to the previous period and to a year ago separates genuine improvement from seasonal noise, and the register burn-down is tracked independently because a falling score with a growing register usually means risks are being accepted rather than fixed. Boards fund trajectory, not position — a 62 that has fallen twelve points in a year is a well-run programme, and a 62 that has been 62 for three years is a stalled one.

Formulas

Cyber Risk Trend

monthlyRate = (currentScore − previousScore) ÷ periodMonths; monthsToTarget = (currentScore − targetScore) ÷ |monthlyRate| when the rate is negative.

monthlyRate
Points of risk reduction per month at the current pace
projectedScore
Current score plus twelve months at the current rate
registerBurnRate
Risks closed minus risks newly accepted per period

Register burn-down

registerMonths = openRisks × periodMonths ÷ (closed − new) — an infinite figure means the register is growing, whatever the score says.

registerBurnRate
Net risks removed per period

Worked example

With the default values below, Cyber Risk Trend Calculator returns Trend Direction of Improving consistently — risk is falling both this period and year on year. Change any input above and every figure here is recalculated in your browser.

Inputs used

Current risk scoreaccepts 0–100 / 100
62 / 100
Score one period agoaccepts 0–100 / 100
68 / 100
Score a year agoaccepts 0–100 / 100
74 / 100
Length of one periodaccepts 0.5–24 months
3 months
Target risk scoreaccepts 0–100 / 100
40 / 100
New risks accepted per periodaccepts 0–10,000 risks
6 risks
Risks remediated per periodaccepts 0–10,000 risks
9 risks
Open risks on the registeraccepts 0–100,000 risks
84 risks

Results

Trend Direction
Improving consistently — risk is falling both this period and year on year
Change This Period
-6.0 points
Annualised Change
-24.0 points/year
Time to Reach Target
11.0 months
Projected Score in 12 Months
38.0 / 100
Register Burn-Down Rate
3.0 risks/period
Time to Clear the Register
84.0 months

Step by step

  1. 1Values used
  2. 2Cyber Risk Trend
  3. 3Register burn-down
  4. 4Trend Direction= Improving consistently — risk is falling both this period and year on year
  5. 5Change This Period= -6.0 points
  6. 6Annualised Change= -24.0 points/year
  7. 7Time to Reach Target= 11.0 months
  8. 8Projected Score in 12 Months= 38.0 / 100
  9. 9Register Burn-Down Rate= 3.0 risks/period

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cyber Risk Trend calculated?

monthlyRate = (currentScore − previousScore) ÷ periodMonths; monthsToTarget = (currentScore − targetScore) ÷ |monthlyRate| when the rate is negative. A single risk score is nearly meaningless; the direction and the rate are what tell you whether the programme is working. Comparing both to the previous period and to a year ago separates genuine improvement from seasonal noise, and the register burn-down is tracked independently because a falling score with a growing register usually means risks are being accepted rather than fixed.

Why does Cyber Risk Trend matter?

Boards fund trajectory, not position — a 62 that has fallen twelve points in a year is a well-run programme, and a 62 that has been 62 for three years is a stalled one.

What values do I need to enter?

This calculator takes 8 inputs: Current risk score, Score one period ago, Score a year ago, Length of one period, Target risk score, New risks accepted per period, Risks remediated per period, Open risks on the register. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why compare against both last period and last year?

Because quarterly movement is noisy — an audit, a new tool or a reclassification can move the score several points without anything real changing. The year-on-year figure is what confirms a trend.

What if the score improves while the register grows?

That is the classic warning sign that risks are being accepted rather than remediated, or that scoring is drifting. Trust the register burn-down over the score when the two disagree.

Related Calculators

Cyber Risk Trend Calculator – Calculate Trend Direction