After Action
Get a Demo

Mispriced Risk Model

The 6-score mispriced risk model — Exposure Score, Preparedness Score, Third-Party Risk, Breach Environment, Actual Risk, and Mispriced Risk delta.

The Mispriced Risk model identifies the gap between what an organization believes its risk posture to be and what the data actually shows. It uses six interconnected scores to surface hidden risk that traditional assessments miss.

The 6 Scores

1. Exposure Score (0-100)

Measures the organization's attack surface and threat exposure based on:

  • Industry threat landscape (sector-specific threat intelligence)
  • Organization size and digital footprint
  • Number of third-party integrations and vendor dependencies
  • Public-facing asset count and complexity
  • Historical incident frequency for the vertical

2. Preparedness Score (0-100)

Quantifies how ready the organization is to respond, derived from:

  • Readiness score from the most recent exercise (8-dimension model)
  • Exercise frequency and recency
  • Gap remediation completion rate
  • IR plan documentation maturity
  • Team training and certification levels

3. Third-Party Risk Score (0-100)

Evaluates risk introduced by the vendor and partner ecosystem:

  • Number of critical third-party dependencies
  • Vendor security assessment coverage
  • Supply chain incident history
  • Contractual security requirements and SLAs
  • Third-party access control maturity

4. Breach Environment Score (0-100)

Reflects the external threat environment facing the organization:

  • Active threat campaigns targeting the industry (MITRE ATT&CK + CISA KEV)
  • Regulatory enforcement activity in the sector
  • Recent breaches at peer organizations
  • Geopolitical risk factors affecting the vertical

5. Actual Risk Score (0-100)

The composite risk score combining Exposure, Third-Party Risk, and Breach Environment, offset by Preparedness. Calculated as:

Actual Risk = (Exposure * 0.35) + (3P Risk * 0.25) + (Breach Env * 0.25) - (Preparedness * 0.15)

6. Mispriced Risk (Delta)

The difference between the organization's perceived risk (often reflected in their insurance coverage or self-assessment) and the Actual Risk score. A positive delta means the organization is underestimating its risk — the most dangerous condition.

Using the Model

The Mispriced Risk model is presented in the Ops and Client dashboards as a visual comparison chart. It provides concrete evidence for conversations about:

  • Insurance coverage adequacy
  • Security investment prioritization
  • Board-level risk communication
  • Remediation urgency and budget justification

The model updates dynamically as new exercises are completed, gaps are remediated, and the threat environment evolves.