{
  "id": "workflow:cyber-risk-scenario-modeling",
  "_kind": "Workflow",
  "_file": "workflows/workflows/workflows-cyber-risk.yaml",
  "_cluster": "workflows",
  "attributes": {
    "displayName": "Cyber Risk Scenario Modeling",
    "workflowKind": "governance",
    "triggerType": "scheduled",
    "typicalCadence": "quarterly",
    "complexity": "cross-team",
    "description": "Quantifies cybersecurity risk exposure using structured risk\nframeworks -- applying FAIR (Factor Analysis of Information Risk)\nmethodology to model loss event frequency and loss magnitude for\npriority threat scenarios, incorporating vulnerability assessment\nresults and threat intelligence into calibration inputs, running\nMonte Carlo simulations to produce annualized loss expectancy\ndistributions, developing loss exceedance curves for executive risk\ncommunication, comparing scenario-based risk quantification against\ncyber insurance coverage limits, and prioritizing security\ninvestments based on risk-reduction return on investment. Produces\ncyber risk quantification reports, loss exceedance curves, and\ninvestment prioritization matrices. Excludes security control\nimplementation and insurance procurement.\n"
  },
  "outgoingEdges": [
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "role:security-risk-analyst",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "role:security-reviewer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "role:data-scientist",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "skill-area:threat-modeling",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "skill-area:python-data-pipelines",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "domain:cybersecurity-grc",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "domain:security",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "responsibility:threat-modeling",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "responsibility:risk-reporting",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "org-unit:security-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    },
    {
      "from": "workflow:cyber-risk-scenario-modeling",
      "to": "org-unit:risk-management-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}