Before a single scenario is modelled or a number estimated, one of first challenges in adopting cyber risk quantification (CRQ) is simply persuading stakeholders it's worth doing.
CRQ often begins not with a proof of concept, but with a leap of belief — a willingness to explore a new way of framing risk, even before it's been validated internally. This belief can be hard-won, because it asks stakeholders to reconsider long-held views about risk, decision-making, and the limits of current frameworks.
Advocating for CRQ means asking stakeholders to adopt a new lens. That kind of trust is rarely built through logic alone.
This blog explores five objections I frequently hear when introducing CRQ. These aren't hostile challenges — they're thoughtful concerns, often raised by leaders trying to ensure their teams stay focused on what matters. That's exactly why they deserve thoughtful responses. These are the kinds of conversations that set the tone and often determine whether CRQ ever gets off the ground.
The visual below aims to capture the essence of each.
In each objection, I have included:
Earning belief in CRQ isn’t about conversion — it’s about credibility, one conversation at a time.
“Isn’t this too subjective?”
As heard in the wild:
“I see the appeal, but how much of this is judgement dressed up as data?
Why this concern is reasonable:
Stakeholders are right to be cautious about turning uncertainty into numbers. Even without seeing quantification fail, many are alert to the risk of false precision. Their concern isn’t CRQ itself — it’s how credible the foundations are.
How to reframe it constructively:
CRQ doesn’t remove judgement; it makes it visible, challengeable, and more reliable. Calibrated expert judgement — a powerful and often underused tool — helps organisations think probabilistically, incorporate diverse views, and surface assumptions. In this frame, CRQ shows where judgement is applied and how confident we can be. The goal isn't to remove human insight, it's to channel it more reliably.
What I've seen work in practice:
Lines that can move the conversation forward:
When stakeholders worry CRQ is "too subjective", it helps to show where it sits on the broader spectrum — and how it compares to the tools we're already using.
“How do we know it’s accurate?”
As heard in the wild:
“We'll never be able to 'prove' the results so how can we trust them enough to make decisions?”
Why this concern is reasonable: For many leaders, trust in a model is tied to verifiability. If CRQ outputs can’t be tested, they risk sounding like opinion, not insight — especially in a data-poor, fast-moving domain like cyber.
How to reframe it constructively: CRQ isn’t about perfect foresight. It’s a structured way to reason under uncertainty — bringing together data, context, and judgement in a transparent and testable way. Accuracy means being directionally right, not precisely perfect. Confidence grows when scenarios align with real-world events faced by similar organisations.
What I’ve seen work in practice:
Lines that move the conversation forward:
“Are we mature enough for this?”
As heard in the wild:
“We’re still fixing the basics like inventories and access controls. Shouldn’t we get those right before we try something like CRQ?”
Why this concern is reasonable: CISOs are right to be cautious about sequencing. When core capabilities are still forming, it can feel premature to add a more advanced layer.
How to reframe it constructively: CRQ isn’t something you do after you're mature — it helps you mature more strategically. It highlights where improvements matter most and can shift senior focus from control checklists to real risk. It’s not, for example, about saying DLP doesn’t matter — it’s about showing whether it matters enough.
What I've seen work in practice:
Lines that can move the conversation forward:
“What if it contradicts existing narratives?”
As heard in the wild:
“We’ve told the Board we’re within appetite. What if CRQ says otherwise?”
Why this concern is reasonable: Leaders are right to be cautious. Risk narratives have likely been communicated to Boards and regulators.
How to reframe it constructively: CRQ isn’t about proving past conclusions wrong — it’s about improving future ones. It sharpens, validates, or reconsiders earlier judgements based on better tools. Positioning CRQ as an evolution can reduce defensiveness and opens the door to learning.
What I've seen work in practice:
Lines that can move the conversation forward:
“It sounds interesting, but why now?”
As heard in the wild:
“We already have risk matrices and appetite frameworks — what's the urgency?”
Why this concern is reasonable: CRQ often arrives without a burning platform. It’s not on a regulator’s checklist (yet), and it doesn’t plug a glaring control gap. So the question becomes: is the value clear enough to prioritise today?
How to reframe it constructively: This isn’t about replacing what works — it’s about adding depth where it’s missing. CRQ helps with trade-offs, cost-benefit clarity, and appetite expressed in financial terms. And while there’s no burning platform today, expectations are rising. Boards are asking better questions. CRQ helps you answer them.
What I've seen work in practice:
Lines that can move the conversation forward:
CRQ isn’t a hard sell — and it shouldn’t be.
The goal of these conversations isn’t to convert sceptics on the spot. It’s to create space for new ways of thinking. To offer clearer language, more defensible insight, and a way to navigate complexity without defaulting to colour codes and gut feel.
These objections aren’t fringe views. They’re thoughtful, informed questions raised by people who’ve carried real accountability for risk — and who want to make sure their next step is better than their last.
Handled well, these aren't objections to be overcome. Instead, they should be thought of as opportunities to earn trust.
Because every concern addressed builds confidence. Every quiet objection handled with care becomes an invitation to rethink. And every practitioner who’s prepared — not just with a model, but with the language and mindset to lead change — helps move the discipline forward.
CRQ doesn’t need to be introduced with fanfare. It often starts quietly with a well-framed conversation. The kind that earns a first yes. And from there, momentum builds
Earning the first “yes” is a significant milestone — but it’s just the beginning.
In the next blog, I’ll explore what separates short-term pilots from long-term success. From governance to data, process to tooling — this is where CRQ stops being a side project and starts changing how decisions get made.
If you’re preparing for that journey, we'd be happy to help.
