Why Businesses Don't Buy "14 Critical Vulnerabilities"
Business management operates in three categories: revenue, costs and risks. Severity, CVSS score, lateral movement - none of these words fall into any of them. The result: red team is perceived as an item of expenditure without measurable return.
Corporate culture of cybersecurity in most organizations revolves around the appendix - "we have been audited, we meet the requirements." Red team by definition breaks this illusion, showing that formal compliance with standards (ISO 27001, GOST R 57580) is not equal to real security. For business, this is an uncomfortable truth, and you need to submit it in the right package.
The most common framework is the model Annualized Loss Expectancy (ALE), adapted for red team engagement. It translates technical findings into the language of financial risks. And what is nice - it is counted on a napkin.
Calculation formula
Step 1. ALE without red team:
ALE = SLE × ARO
• SLE (Single Loss Expectancy) - the full cost of one incident: response, lawyers, regulatory fines, loss of customers, reputational damage. According to IBM Cost of a Data Breach Report, the average cost of the leak is global - $ 4-5 million, and in the United States can exceed $ 9-10 million (depends on the year of the report)
• ARO (Annual Rate of Occurrence) - the probability of exploiting the vulnerability during the year without elimination
Step 2. Full cost of the program:
Стоимость RT = Гонорар + Время внутренних сотрудников + Ремедиация + Ретест
Step 3. ROI:
ROI = ((ALE_без − ALE_с) − Стоимость_RT) / Стоимость_RT × 100%
Example of calculation
The financial institution orders the annual red team assessment. The estimate of the cost of the incident is 300 million rubles. (fines of the Central Bank, simple systems, loss of clients, lawyers). ARO without red team - 0.25 (once every 4 years, conservative estimate for the financial sector). ARO after red team and remediation - 0.10.
Risk reduction: 75 000 000 − 30 000 000 = 45 000 000 rub.
The cost of the red team program (assessment + remission + retest): 8 000 000 rub.
ROI = (45 000 000 − 8 000 000) / 8 000 000 × 100% = 462%
For each ruble invested - 4.6 rubles of prevented losses.
Here it is necessary to make a reservation: ARO is an expert assessment, not an exact figure. But even with the most conservative assumptions, the ROI red team usually exceeds 200%. For CFO, this is more convincing than any CVE list. Try to bring him Excel with such a sign - the conversation will go quite differently.
For a more detailed analysis, you can take the methodology of FAIR (Factor Analysis of Information Risk), which decomposes the risk on Loss Event Frequency and Loss Magnitude - but for the first pitch ALE-model is enough for the eyes.
Reconfigured performance metrics for pentest report management
One table with ROI is a good start, but for sustainable funding, there is not much to achieve a year. You need a set of metrics that shows the dynamics. Management loves trends - give them trends.
Financial Metrics
• Cost avoidance ratio - the ratio of the preventable damage to the cost of the program. Target threshold: 4:1 and above. Below 3:1 - reason to revise the scope or methodology
• Reduced insurance premiums - organizations with a documented red team program can receive a discount on cyber insurance. Such savings partially compensates for the cost of assessment (clarify your insurer - the spread of the market is large)
• The cost of remediation for the find - track year-on-year. If it decreases, then the basic maturity of the organization’s cybersecurity is growing, and you can prove it with numbers
Operating metrics
• MTD (Mean Time to Detect) – how quickly the SOC detects red team’s actions. According to industry observations, teams working regularly against red team improve the detection by 25-40% within 12 months. This is perhaps the most visual metric for the leadership
• Trend of severity finds - distribution Critical / High / Medium / Low by sequential engagements. Shift towards Medium / Low in 2-3 years = maturity of protection is growing, investments are paying off
• The percentage of incorrectly configured SZI - from the experience of the industry, the first red team assessment is almost always found at least one means of protection that is configured incorrectly or does not work at all. This one metric often justifies the entire investment. On one project, we found an EDR that had a broken behavioral analysis module - stood as a decoration for three months
Summary Template: the Cyber Security Budget in one document
A 80-page technical report will not be read by any of the manuals. You need a executive summary for one page. Here is the structure that worked in my practice:
1. The purpose is one scope: "Assess the sustainability of the infrastructure to the target attack of the level of APT, period: DD.MM-DD.MM, model: the alleged external attacker"
2. The key result is one figure: “Full control over AD infrastructure is received in N Hours”
3. Business impact - what could a real attacker do: ERP stop, access to financial systems, expating PD (the volume of records + potential fines for 152-FZ)
4. Financial risk assessment - ALE table before and after remediation, final ROI
5. The top 3 critical chains of attack are not separate vulnerabilities, but complete chains. Example: Spearphishing Attachment (T1566.001, Initial Access) -> Valid Accounts (T1078, Persistence/Privilege Escalation) -> OS Credential Dumping (T1003, Credential Access) -> Full Domain Compromise. Each chain is described in business terms: "from an attachment letter to access to 1C in 48 hours"
6. Dynamics - comparison with the past of engagement: MTTED, the number of critical finds, the time to get privileged access
7. Recommendations with priorities - three levels: "fix for 2 weeks / 1 month / 1 quarter", each with an estimate of the decrease in ALE in rubles
The format works because the management sees the usual structure: the problem is -> the price of the problem -> solution -> cost of the solution -> ROI. Similarly, CFO evaluates any other business project. You just stop being “incomprehensible hackers” and become a unit that can count money.
Security Intelligence and Corporate Culture: Red Team Side Effect
Financial justification is a necessary, but not sufficient condition. Red team gives an effect that is difficult to calculate in money, but which is critical for the maturity of the organization.
Security awareness ceases to be a formality. When the SOC Analyst Misses the Chain from Exploit Public-Facting ApplicationT1190, Initial Access) through Exploitation for Privilege Escalation (T1068) to Disable or Modifi Tools (T1685, Defense Evasion) is a lesson that will not replace any slide "do not click on suspicious links." After red team engagement, the formal awareness-training turns into a subject matter of specific scenarios. The difference is like between the traffic textbook and the drift on the wet track.
Blue team gets practice on real TTP. Between "we know what Kerberoasting is" and "we have detected Kerberoasting in our infrastructure in 4 minutes" - the abyss. Red team closes this gap without the consequences of a real incident. Training on a live range, not on slides.
The management begins to make informed decisions. After the engagement, where the red team reached the financial systems through a compromised VPN account, a conversation about the budget for the MFA from “why do we” turn into “when we implement”. This cultural shift is an additional argument for the business case: red team not only reduces the likelihood of an incident, but raises the overall level of information security risk management in the organization.
Business management operates in three categories: revenue, costs and risks. Severity, CVSS score, lateral movement - none of these words fall into any of them. The result: red team is perceived as an item of expenditure without measurable return.
Corporate culture of cybersecurity in most organizations revolves around the appendix - "we have been audited, we meet the requirements." Red team by definition breaks this illusion, showing that formal compliance with standards (ISO 27001, GOST R 57580) is not equal to real security. For business, this is an uncomfortable truth, and you need to submit it in the right package.
The most common framework is the model Annualized Loss Expectancy (ALE), adapted for red team engagement. It translates technical findings into the language of financial risks. And what is nice - it is counted on a napkin.
Calculation formula
Step 1. ALE without red team:
ALE = SLE × ARO
• SLE (Single Loss Expectancy) - the full cost of one incident: response, lawyers, regulatory fines, loss of customers, reputational damage. According to IBM Cost of a Data Breach Report, the average cost of the leak is global - $ 4-5 million, and in the United States can exceed $ 9-10 million (depends on the year of the report)
• ARO (Annual Rate of Occurrence) - the probability of exploiting the vulnerability during the year without elimination
Step 2. Full cost of the program:
Стоимость RT = Гонорар + Время внутренних сотрудников + Ремедиация + Ретест
Step 3. ROI:
ROI = ((ALE_без − ALE_с) − Стоимость_RT) / Стоимость_RT × 100%
Example of calculation
The financial institution orders the annual red team assessment. The estimate of the cost of the incident is 300 million rubles. (fines of the Central Bank, simple systems, loss of clients, lawyers). ARO without red team - 0.25 (once every 4 years, conservative estimate for the financial sector). ARO after red team and remediation - 0.10.
Risk reduction: 75 000 000 − 30 000 000 = 45 000 000 rub.
The cost of the red team program (assessment + remission + retest): 8 000 000 rub.
ROI = (45 000 000 − 8 000 000) / 8 000 000 × 100% = 462%
For each ruble invested - 4.6 rubles of prevented losses.
Here it is necessary to make a reservation: ARO is an expert assessment, not an exact figure. But even with the most conservative assumptions, the ROI red team usually exceeds 200%. For CFO, this is more convincing than any CVE list. Try to bring him Excel with such a sign - the conversation will go quite differently.
For a more detailed analysis, you can take the methodology of FAIR (Factor Analysis of Information Risk), which decomposes the risk on Loss Event Frequency and Loss Magnitude - but for the first pitch ALE-model is enough for the eyes.
Reconfigured performance metrics for pentest report management
One table with ROI is a good start, but for sustainable funding, there is not much to achieve a year. You need a set of metrics that shows the dynamics. Management loves trends - give them trends.
Financial Metrics
• Cost avoidance ratio - the ratio of the preventable damage to the cost of the program. Target threshold: 4:1 and above. Below 3:1 - reason to revise the scope or methodology
• Reduced insurance premiums - organizations with a documented red team program can receive a discount on cyber insurance. Such savings partially compensates for the cost of assessment (clarify your insurer - the spread of the market is large)
• The cost of remediation for the find - track year-on-year. If it decreases, then the basic maturity of the organization’s cybersecurity is growing, and you can prove it with numbers
Operating metrics
• MTD (Mean Time to Detect) – how quickly the SOC detects red team’s actions. According to industry observations, teams working regularly against red team improve the detection by 25-40% within 12 months. This is perhaps the most visual metric for the leadership
• Trend of severity finds - distribution Critical / High / Medium / Low by sequential engagements. Shift towards Medium / Low in 2-3 years = maturity of protection is growing, investments are paying off
• The percentage of incorrectly configured SZI - from the experience of the industry, the first red team assessment is almost always found at least one means of protection that is configured incorrectly or does not work at all. This one metric often justifies the entire investment. On one project, we found an EDR that had a broken behavioral analysis module - stood as a decoration for three months
Summary Template: the Cyber Security Budget in one document
A 80-page technical report will not be read by any of the manuals. You need a executive summary for one page. Here is the structure that worked in my practice:
1. The purpose is one scope: "Assess the sustainability of the infrastructure to the target attack of the level of APT, period: DD.MM-DD.MM, model: the alleged external attacker"
2. The key result is one figure: “Full control over AD infrastructure is received in N Hours”
3. Business impact - what could a real attacker do: ERP stop, access to financial systems, expating PD (the volume of records + potential fines for 152-FZ)
4. Financial risk assessment - ALE table before and after remediation, final ROI
5. The top 3 critical chains of attack are not separate vulnerabilities, but complete chains. Example: Spearphishing Attachment (T1566.001, Initial Access) -> Valid Accounts (T1078, Persistence/Privilege Escalation) -> OS Credential Dumping (T1003, Credential Access) -> Full Domain Compromise. Each chain is described in business terms: "from an attachment letter to access to 1C in 48 hours"
6. Dynamics - comparison with the past of engagement: MTTED, the number of critical finds, the time to get privileged access
7. Recommendations with priorities - three levels: "fix for 2 weeks / 1 month / 1 quarter", each with an estimate of the decrease in ALE in rubles
The format works because the management sees the usual structure: the problem is -> the price of the problem -> solution -> cost of the solution -> ROI. Similarly, CFO evaluates any other business project. You just stop being “incomprehensible hackers” and become a unit that can count money.
Security Intelligence and Corporate Culture: Red Team Side Effect
Financial justification is a necessary, but not sufficient condition. Red team gives an effect that is difficult to calculate in money, but which is critical for the maturity of the organization.
Security awareness ceases to be a formality. When the SOC Analyst Misses the Chain from Exploit Public-Facting ApplicationT1190, Initial Access) through Exploitation for Privilege Escalation (T1068) to Disable or Modifi Tools (T1685, Defense Evasion) is a lesson that will not replace any slide "do not click on suspicious links." After red team engagement, the formal awareness-training turns into a subject matter of specific scenarios. The difference is like between the traffic textbook and the drift on the wet track.
Blue team gets practice on real TTP. Between "we know what Kerberoasting is" and "we have detected Kerberoasting in our infrastructure in 4 minutes" - the abyss. Red team closes this gap without the consequences of a real incident. Training on a live range, not on slides.
The management begins to make informed decisions. After the engagement, where the red team reached the financial systems through a compromised VPN account, a conversation about the budget for the MFA from “why do we” turn into “when we implement”. This cultural shift is an additional argument for the business case: red team not only reduces the likelihood of an incident, but raises the overall level of information security risk management in the organization.
