Cyber Resilience Exposure Index (CREI): turning the asset-risk matrix into a decision metric

Small and medium-sized enterprises (SMEs) face disproportionate cyber risk exposure due to persistent financial, technical, and human resource constraints. Although cyber resilience has gained increasing attention, SMEs still lack practical quantitative instruments that enable structured measurement, comparison, and management of cyber risk exposure. This paper addresses this gap by proposing a risk-centric quantitative assessment model for SME cyber resilience. The study introduces the Cyber Resilience Exposure Index (CREI), a composite metric designed to quantify cyber risk exposure across critical organizational assets and major cyber risk categories. The index integrates four dimensions: likelihood-impact risk evaluation, weighted cyber risk categories, asset criticality, and cybersecurity control maturity as a mitigating factor. CREI is calculated across an asset-risk matrix and produces sector-comparable scores on a 0–100 scale, where lower exposure indicates higher resilience. Sensitivity analysis demonstrates the robustness of results under different weighting schemes, while a practical scoring guide and illustrative example support immediate SME adoption. The proposed metric operationalizes cyber resilience as a decision-oriented management tool, strengthening investment prioritization and enabling longitudinal benchmarking across sectors.