A fair new world: Practical insights from implementing cyber risk quantification at enterprise scale

Cyber risk quantification (CRQ) is gaining traction, but many organisations struggle to move from theory to practical, enterprise scale application. This session shares first hand, real world insights from Telstra’s cyber risk quantification journey, leveraging the Factor Analysis of Information Risk (FAIR™) model to transform how cyber risk is understood, communicated, and acted upon.

This talk is not a deep technical dive into FAIR™ mathematical algorithms, loss expectancy curves, or statistical mechanics. Instead, it focuses on the practical realities of implementing a quantification program inside a large Australian enterprise including the objectives, approach, challenges, and lessons learned along the way.

Attendees will hear how Telstra are transitioning from subjective, qualitative cyber risk assessments to a quantitative, dollar based view of cyber risk, enabling stronger board reporting, improved prioritisation of security investment, and tighter integration with Chief Risk Office processes. 

The session will explore challenges such as data integration, loss magnitude estimation, scaling results across the enterprise, and the financial expertise required to produce board defensible outcomes.

The presentation will also cover how quantified insights are actioned through both security program uplift and targeted remediation, how risk ownership is enabled at a group level, and how trust in quantified results is built over time.

This session is designed to provide practical takeaways for security, risk, and GRC professionals looking to apply FAIR™ within Australian organisations and accelerate their own cyber risk quantification journey.