Experts as a service: Crowd-based forecasting for cyber risk quantification

Every board asks the same question: "How much could a cyber attack cost us?" And every year, most security teams answer with a heatmap — red, amber, green — that tells the board almost nothing about financial exposure.

The tools exist to do better. FAIR-based quantification platforms can model loss scenarios for the assets we can scan. But what about the ones we can't? Operational technology in power stations. Air-gapped networks in defence. Legacy SCADA in water treatment. These are often the highest-consequence systems in an organisation, and they sit in a blind spot because no scanner can reach them.

This session introduces a different approach: crowd-based expert forecasting — a structured method for turning the distributed knowledge of security professionals into a calibrated, dollar-denominated risk signal.

The concept draws on prediction markets and structured expert elicitation — techniques proven in intelligence analysis, epidemiology, and financial markets — and applies them to cyber risk.

Security practitioners — penetration testers, threat intelligence analysts, engineers, and even peer organisations — are invited to forecast risk outcomes for specific parameters: How likely is initial compromise of this system? What's the probable downtime if ransomware hits this environment? What's a realistic data exfiltration volume?

Each forecast is a structured estimate — a minimum, most likely, and maximum value — not a single guess. The platform aggregates these into a consensus using accuracy-weighted scoring: forecasters who have been more accurate in the past carry more influence in the consensus. Over time, the signal self-corrects.

The result is a continuously updated Annual Loss Expectancy and Value-at-Risk figure that covers every asset in the portfolio — including the ones no tool can scan.

Regulatory pressure is converging. The SOCI Act requires Australian critical infrastructure operators to assess cyber risk in financial terms. The SEC mandates material cyber risk disclosure. Europe's DORA and NIS2 impose similar obligations across financial services and essential services. Collectively, these frameworks affect hundreds of thousands of organisations — and most have no credible way to produce the numbers.

Crowd-based forecasting fills the gap. It scales expertise without scaling headcount. It produces auditable, defensible estimates. And it creates a network effect: the more practitioners participate, the more accurate the risk pricing becomes.

This session will cover the methodology behind crowd-calibrated cyber risk quantification, demonstrate how expert forecasts are aggregated and weighted, and show how the approach integrates with existing FAIR-based frameworks. 

Attendees will see a live demonstration of the forecasting engine, including how anonymous signals from peer organisations can refine risk estimates without exposing sensitive data.

Whether you're a CISO trying to translate risk for the board, a consultant delivering risk assessments, or a practitioner curious about where quantification is heading — this session offers a practical, working alternative to the heatmap.