Cyber risk management: an illusion of a risk-based approach

Abstract In this study, we investigate how organizations align qualitative and quantitative approaches to measure and manage cyber risk effectively. Cyber risk involves the potential compromise of data integrity, availability, or confidentiality due to attacks or incidents. We draw on the theoretical framework of calculative cultures, describing the qualitative and quantitative organizational approaches to risk management. We conducted twenty-seven in-depth interviews with individuals involved in cyber risk management from five multi-billion-dollar organizations. We find that while organizations claim to rely on risk-based (quantitative) management, they measure cyber risk qualitatively with a ‘quantitative veneer’ - that is, merely giving the appearance of using quantitative methods. This mismatch creates the illusion of a risk-based approach. We extend the literature of calculative cultures with the concept of 'qualculation'. It combines qualitative and quantitative approaches and suggests that 'qualculation', not quantification, is the highest standard that could be attained in aligning measurement and management of cyber risk.