Boards do not fund control counts. They fund decisions about money.
Today we shipped the thing that closes that gap. Crush Dollar Exposure is live in the Crush platform as of this morning, alongside our new website. It takes the security posture we already track for you (controls, coverage, threat activity, compliance state) and turns it into the number your board has been asking for: expected annual loss, in dollars, with the math showing.
Here’s what it does, why we built it the way we did, and what it means for where Crush is going.
What shipped
Four numbers, each with its basis attached:
- Annualized financial exposure. Expected annual cyber loss in dollars, with an uncertainty band instead of false precision.
- Exposure as a share of revenue. The same figure in business terms, so leadership can judge whether it’s proportionate.
- Value-at-Risk and a loss-exceedance curve. The tail view a finance audience expects: the loss you’re unlikely to exceed at 95 and 99 percent confidence, not just the average.
- Control gaps priced in dollars. Every open control ranked by the annualized loss its gap drives, highest first.
That last one is the point. Total exposure tells a board how much is at stake. The priced gap list tells your team what to fix first, and the per-control dollars reconcile exactly to the headline number, so the detail never contradicts what leadership already saw.
Why there’s no AI in the number
This was the first architectural decision we made, and the one I care most about.
Cyber risk quantification has two failure modes. The black-box score: a vendor hands you a number with no visible math, and no CISO can defend it to an auditor. And the consultant spreadsheet: a one-time estimate that’s stale the day it lands and can’t be reproduced.
We refused both. The Crush Dollar Exposure calculation is deterministic. Same inputs, byte-identical output, enforced by test. The model is FAIR-informed: likelihood times magnitude per loss scenario (data breach, ransomware and outage, third-party compromise, software supply chain), summed into a headline that always decomposes into explainable parts. A seeded Monte Carlo simulation carries it from expected loss to the full loss distribution.
Cassandra, our AI advisor, explains the results and helps you work the priorities. It never computes a dollar figure. A board metric has to be reproducible on demand, and generative AI in the number path breaks that contract.
The Number Is Only as Credible as Its Inputs
Three design choices make it defensible:
Coverage is objective, not self-assessed. A control counts only when it’s satisfied by deployed tooling or Crush-validated evidence. Self-declared maturity scores never inflate the model.
Threat weighting reflects real attacker activity. Controls crosswalk to NIST CSF and on to MITRE ATT&CK, weighted by the techniques actually in use against your industry. A gap that active adversaries exploit costs more than one they ignore.
Magnitude comes from recognized data, carried with provenance. Loss references draw on the Verizon DBIR, the IBM Cost of a Data Breach study, and public 10-K breach disclosures. Every figure ships with its sources, an as-of date, and a confidence rating. When an input is missing, the model lowers its confidence and says so. It does not fill the gap with a guess.
What this changes for CISOs and CFOs
The remediation conversation flips. Instead of “we have 140 open controls,” your team says “closing these controls removes the most expected loss, in this order, and here’s the scenario each one drives.”
That’s the same language the CFO uses for every other investment decision. Budget season stops being a negotiation over fear and starts being a comparison of loss reduction per dollar spent. And when the board asks whether last year’s spend made a measurable difference, you have a number that moves and a basis you can show.
What it means for Crush
This is the platform crossing the line we’ve been building toward: from showing you the problem to pricing it.
The platform already maps your stack, your coverage, your compliance posture, and the threat activity against your industry. Crush Dollar Exposure runs on that same evidence, so the dollar figure your board sees is connected to the data your team works from every day. No separate assessment, no imported spreadsheet, no annual consulting engagement that expires.
And the model that got us here doesn’t change. The core intelligence platform remains included at no separate subscription cost with eligible engagements. We don’t sell you the score. The number exists to drive a decision, and when the decision is made, we’re the team that executes it: sourcing, negotiation, implementation, and the services to run what you buy. Quantification without execution is just a prettier report. We built the loop.
How we run our own shop matters here too. Calculations run inside each customer’s data boundary. Only anonymized industry aggregates cross tenants. Figures headed to a board get human review by a Crush field security leader first. And Crush is ISO 27001:2022 certified, with SOC 2 Type II in progress.
See the math
The technical white paper documents the model: the inputs it consumes, the math that turns them into a dollar figure, and the controls that make the output defensible. If you’re the person who needs to see how the number is produced before you’ll trust it, that paper was written for you.
Crush Dollar Exposure is live in the platform today. Want to see your organization’s number? Start at crushsecurity.com/dollar-exposure. Want the math first? Email info@crushsecurity.com and ask for the technical white paper.
Your board already thinks about risk in dollars. Now your security program can too.