Resources

Answers you can get without asking us

Two assessments that return a number about your own organisation, the write-ups behind the method, and a reference library you can search on your own terms. Nothing here is gated behind a sales call.

Start with a number of your own

Both are free, run in the browser, and ask nothing you would not put in a board pack. Neither one needs data you do not already have.

Maturity self-assessment Where do you stand on cyber risk quantification? Seven questions, one per dimension, scored from Absent to Quantified. Anything you score 3 or below comes back as a named gap with a recommended next action.
  • Takes2 minutes
  • Scores7 maturity dimensions
  • You getYour weakest dimensions, each with a recommended action
Take the self-assessment Lightweight quantification What would a breach actually cost you? A short FAIR-based model of your loss exposure — frequency, magnitude and the controls that move them — expressed as an annualised figure rather than a colour on a grid.
  • Takes5 minutes
  • MethodFAIR loss-exposure model
  • You getYour estimated annual exposure, as a PDF report
Quantify my exposure

Write-ups from the practice

Long-form notes on quantifying cyber risk, modelling loss with FAIR, and meeting Indian regulatory expectations — written for the people who have to defend the numbers in the room.

Regulatory 9 min read

“Reasonable Security Safeguards” Is Now a Number

The DPDP Act attaches its largest penalty to a duty it deliberately declines to define. That is not a drafting gap — it is an instruction to show your reasoning.

Read the write-up →
FAIR 10 min read

FAIR Without the Folklore

Most objections to quantifying cyber risk are really objections to bad quantification. What separates a model that survives scrutiny from one that gets dismissed is a handful of disciplines — none of which need data you do not have.

Read the write-up →
Cyber Risk Quantification 8 min read

Your Board Doesn’t Want a Heat Map

The problem with the red-amber-green grid is not that it is imprecise. It is that it cannot be compared, aggregated, or acted on — which is everything a board needs a risk report to do.

Read the write-up →
All Insights

The questions we get asked

Answered once, properly, so you do not have to book a call to find out what FAIR needs as input or what the RBI actually expects to see.

36 answers across nine topics — quantification, FAIR, GRC, threat intelligence, ASM and Indian regulatory readiness. Browse all FAQs

Read up on a discipline

One guide per topic: what it is, why programmes fail at it, and what running it properly looks like. Each ends with its own four answered questions.

Cyber Risk Quantification Exposure as a probable financial loss, so security spend is argued on the same terms as every other investment. FAIR Risk Quantification The open standard behind the numbers — what the model measures, and why it holds up under scrutiny. Cybersecurity GRC Why obligations in spreadsheets never meet live risk data, and what integrated GRC changes about that. AI Threat Intelligence Intelligence that says what is likely to happen to you, to which business service, and what it would cost. Attack Surface Management The surface changes daily. A quarterly scan describes an environment that no longer exists. RBI Cybersecurity Compliance Obligations that assume demonstrable, ongoing oversight rather than an annual assertion. DPDP Compliance Personal data as a governed asset, with real financial consequences attached to getting it wrong. Third-Party Risk Management A questionnaire records what a vendor said once. The exposure it creates keeps changing. vCISO Services Senior security leadership at the cadence the organisation needs, without a full-time hire to justify.

What practitioners say

4Sight’s FAIR-based quantification is one of the few I’ve seen that actually translates technical findings into numbers a risk committee can act on, not just another dashboard.
Tapan Independent Cybersecurity / Risk Consultant, Mumbai

Partners taking 4sight into new markets, and independent advisors reviewing it for their own clients, on what it changed in the room.

Read all testimonials

Know your cyber risk before it becomes a business crisis.

Start with a free assessment, or book a 30-minute walkthrough against your own environment.

Book a 30-Minute Demo Assess My Cyber Risk