Blog Post
Top-Down vs Bottom-Up Cyber Risk Quantification
October 19, 2026
Run both approaches against one company and the figures differ, which is expected. The useful part is that they differ in a predictable direction, which makes the distance between them informative rather than embarrassing.
Bottom-up tends to come in lower and top-down higher, for reasons that follow from how each is built. Knowing which way each one leans is more useful than choosing between them.
What Does Each Approach Consume?
Entirely different data, which is the practical reason organizations end up with one rather than the other.
Top-Down Inputs
Revenue, margin, sector, headcount and a maturity position, set against observed loss experience across comparable organizations. The inputs are mostly already known to finance, so a figure can exist within days of deciding to produce one.
Bottom-Up Inputs
An asset inventory with values attached, per-system interruption costs, recovery objectives and control coverage per asset. The inputs mostly do not exist in collected form, so the first figure arrives after the inventory work rather than before it.
Which Constraint Usually Decides
Time to first answer. An organization needing a number for a board meeting in three weeks is choosing top-down whether or not it frames the decision that way.
Why Does Bottom-Up Come In Lower?
Two structural reasons, and both are understatements rather than errors.
It Counts Only What Is Listed
An asset absent from the inventory contributes nothing to the total. Since inventories are incomplete in every organization that has ever audited one, the aggregate is missing whatever the inventory is missing.
It Treats Assets as Independent
Summing per-asset losses assumes the events are separate. One incident reaching forty systems through a shared credential or a common dependency produces a loss larger than any single asset suggests, and summing independent scenarios understates the tail works through the arithmetic.
Which Part of the Curve It Distorts
The extreme end disproportionately. Typical years are built from a few unrelated incidents and survive the independence assumption, while the severe end is precisely where correlation does the damage.
Why Does Top-Down Come In Higher?
Because the comparison set includes organizations managed worse than yours.
Benchmark Drift
Loss experience across a sector reflects the sector's average control posture. An organization materially better than that average inherits an exposure figure that credits none of the difference.
The Limited Correction
A maturity rating adjusts the figure coarsely, moving it by a factor rather than by control. The adjustment cannot distinguish an organization with excellent segmentation from one with excellent patching, and those remove different losses.
Where It Is Nonetheless Right
At the extreme end, where correlation is already embedded in the observed experience rather than assumed away. The approach that is coarser about controls is more faithful about aggregation.
What Does the Spread Tell You?
More than either figure alone, which is the argument for running both.
- A narrow spread: The inventory is reasonably complete and the controls are close to sector typical.
- Bottom-up far below: Either assets are missing from the inventory or the controls outperform the sector by a real margin.
- Bottom-up above top-down: Unusual, and normally a sign of double counting across scenarios.
How to Tell the Second Case Apart
Count the assets in the inventory against the count in the configuration database or the identity directory. A shortfall there explains the distance without needing to believe anything flattering about the control posture.
Which Decisions Does Each Support?
The question the choice should turn on.
What Top-Down Settles
Insurance limit sizing, appetite thresholds, board reporting and peer comparison. Each needs one defensible organization-level figure and none needs to know which system produced it. Top-down scenarios exist for exactly this set.
What Bottom-Up Settles
Which control to fund, which system to remediate first and whether a specific fix delivered. Each needs attribution to a component, which an organization-level figure cannot supply at any level of precision. Bottom-up quantification is what makes a per-control comparison possible.
What Neither Settles Alone
Whether the program as a whole is improving, which needs a stable organization-level figure and attribution underneath it, which is the case for maintaining both rather than replacing one with the other.
What Should Be Established?
Three things, and the first is a sequencing decision rather than a methodological one.
Which decision is waiting, since a limit renewal and a control budget need different approaches and an organization usually has one of them in front of it. Whether the asset inventory exists in a form bottom-up could consume, because a candid answer determines whether that route is weeks or quarters away. Then whether anything compares the two figures where both exist, as the distance between them is diagnostic and most programs never calculate it. Cyber risk quantification supports both constructions from one model, and the method behind them is documented rather than asserted.
The Distance Between Them Is the Finding
Top-down consumes revenue, sector and maturity against observed loss experience, so a figure can exist in days. Bottom-up consumes an asset inventory with values, per-system interruption costs and control coverage, so the first figure waits on inventory work. Bottom-up comes in lower for two structural reasons, counting only what is listed and treating assets as independent, with the second distorting the severe end of the curve most. Top-down comes in higher because sector loss experience reflects the sector's average control posture and a maturity rating corrects for that only coarsely. Running both turns the spread into a diagnostic, where a wide distance points at either an incomplete inventory or a control posture well above the sector, and counting assets against the configuration database separates the two.
To see a top-down figure and an asset-level build compared on one curve, book a demo with our cyber risk experts.
Top-Down and Bottom-Up FAQs
Speak to an ExpertWhat is the difference between top-down and bottom-up cyber risk quantification?
Why does bottom-up quantification produce a lower figure?
Why does top-down quantification produce a higher figure?
What does the distance between the two figures tell you?
Which decisions does top-down quantification support?
Should an organization use both approaches?
