Defining an Entity in Cyber Risk Quantification (CRQ)

An entity is the unit Kovrr quantifies. Anything that should be modeled on its own can be set up as an entity, whether that means a parent company, one subsidiary, a single manufacturing site, or a portfolio company held by an investment firm. Every quantification result in the platform belongs to one entity, which makes the decision about how an organization is divided into entities one of the first things that shapes the output of a cyber risk quantification program.

‍

What an Entity Represents

‍

The term covers a wide range of structures because organizations are rarely built the same way twice. A global manufacturer with five regional operating companies has five sets of books, five technology stacks, and five security teams reporting through different leaders. A healthcare system might run one security program across every facility while needing separate figures for the hospitals it acquired last year. An entity accommodates either arrangement, since the boundary follows whatever division the business already treats as distinct.

‍

What Each Entity Holds

‍

Each entity carries its own company data alongside its own Cyber-Sphere and security profiles. The company data covers the firmographic and technographic detail the models run on, including revenue, industry, locations, data records, and third-party service providers in use. The Cyber-Sphere maps the asset groups belonging to that entity, which is where granularity enters the model. Security profiles record control maturity against whichever framework the entity reports on, so two entities inside the same group can be assessed against different frameworks at different maturity levels.

‍

Because all three sit at the entity level, quantification results stay attached to the entity that produced them. A loss figure for one subsidiary reflects that subsidiary’s technology, controls, and exposure rather than an average drawn across the parent. Anyone reviewing the number can trace it back to the specific inputs behind it, which matters when a CISO has to defend a figure to a board or a regulator asks how a disclosure threshold was reached.

‍

Choosing How to Divide an Organization Into Entities

‍

The useful question is where the business already draws its own lines. Separate entities make sense wherever the technology environment differs substantially, wherever security is managed by a different team under a different budget, wherever regulatory obligations diverge, or wherever someone needs a standalone number for a board, an insurance placement, or a transaction. Modeling a sprawling group as a single entity produces one blended figure that reflects no part of the business particularly well.

‍

The opposite problem appears when entities are drawn too finely. Splitting an organization into dozens of units that share the same stack and the same controls creates maintenance work and fragments results without improving precision. Most organizations land on a structure that mirrors their existing reporting lines, because those lines already encode which parts of the business are run separately and which are run together.

‍

Assessing Entities Together in a Portfolio

‍

When several entities need to be seen as one, a Portfolio Analysis groups them and shows their combined exposure. The aggregation accounts for the correlations between entities, including shared technologies and common third-party service providers, which means a systemic incident affecting one provider is modeled as hitting every entity relying on that provider rather than as isolated events. A parent company gets group-level exposure without losing the ability to open any single entity underneath it.

‍

Holding companies, investment firms, and multinationals use the same structure for different ends. One wants consolidated figures for group risk appetite, another wants to compare holdings against each other before a transaction, and a third wants to allocate insurance limits across operating companies. The entity remains the unit being measured in all three cases, with the Portfolio controlling how those units are rolled up.

‍

Why the Unit Matters

‍

Quantification answers questions at the level it was run. Setting up entities thoughtfully at the start determines whether the output can answer the questions the business will ask of it later, including which subsidiary carries the most exposure, where a control upgrade produces the strongest return, and whether a single site would trigger a materiality threshold on its own. For a broader explanation of the discipline these results come from, read our overview of what cyber risk quantification is.

‍