One screen answers the board’s two questions.
Are we within appetite, and where do the bad years come from? This is the demo company as its board reads it: every figure from the same simulation, every figure in money.
Where the bad years come from
Share of the 1-in-100 year loss, by scenario. This is where a decision moves the tail.
What is worth doing
Each planned action, priced against the expected loss it removes on the same simulated years. Switch them on and off.
A heat map cannot tell a board what is at stake.
It shows which boxes are red. It cannot say how much could be lost, whether the company is inside what the board accepts, or which action is worth its cost. Measura answers all three in money.
| The board asks | A heat map with 1–5 scores | Measura |
|---|---|---|
| How much is at stake? | A colour | An amount in euros, with its probability |
| What does it add up to? | Scores cannot be added | One company-wide curve |
| Are we within appetite? | A matter of opinion | Checked against the curve the board approved |
| Is an action worth its cost? | Cannot be compared with cost | Expected loss removed per euro spent |
Every risk gets two numbers instead of a colour.
That is the risk index Measura applies. For each scenario, the people closest to it estimate the chance it happens in a year and a 90% range of what it would cost. Everything else the board sees, from the expected loss to the company-wide curve, is calculated from those two numbers.
One risk, measured
The demo company’s ransomware scenario, as its risk owner estimated it.
Each square is a year. Over 25 years, expect it about three times.
The estimator is 90% sure a loss would land inside the shaded range. Half the outcomes fall below €1.5m, and the long right tail is where the expensive surprises sit.
Every risk on one map
Further right is more likely, higher up costs more when it happens. Change what the bubble size shows to see why the average year alone misleads.
Measured by the average year, the largest customer and ransomware come first, at about €290k and €280k a year.
View as table
Then the twelve risks are added up. 100,000 simulated years, including the years when several strike at once, turn them into the single curve the board reads against its appetite. See the curve
An AI assistant that helps your people find and measure their risks.
Measura comes with an AI assistant whose skills follow the method itself: which risks to look for, how to phrase them so they can be checked, what to count in the cost and how wide a range should honestly be. It asks and it challenges. It never makes up the numbers.
Find the risks that matter
Starts from a library of scenario templates across seven risk categories and suggests what a company like yours should consider.
Phrase them so they can be checked
Turns a worry like “a cyber attack” into a specific event you could tell afterwards whether it happened.
Count the full cost
Walks through the loss components and the questions an experienced estimator would ask, from downtime to penalties.
Challenge the range
Flags ranges that look too narrow or too wide and asks the question that corrects them, alongside the built-in calibration training.
People own every number. The assistant suggests wording and asks questions. Only a named estimator can save an estimate, and the audit trail shows who did, so the board report stays defensible.
Five questions, one curve.
Each question is answered in money and probability, never with scores, and every answer feeds the next. The board reads the result in two minutes.
What could go wrong?
Ten to twenty-five specific risk events, each written so you could tell afterwards whether it happened. The AI assistant helps find and phrase them.
How likely, and how costly?
An annual probability and a 90% range of loss for each, from people trained to be honest about uncertainty.
What does it add up to?
100,000 simulated years become one curve: the chance of losing more than any amount in a year.
Is it more than we accept?
The curve meets the appetite the board approved. Within or exceeds, nothing in between.
What is worth doing?
Actions are ranked by the expected loss they remove per euro they cost, before anyone signs a budget.
And it gets sharper every quarter. Recorded incidents update the probabilities, value of information shows which uncertainty is worth reducing next, estimators stay calibrated, and each period is frozen so every number in the board report can be reproduced.
Risk becomes a decision you can price, compare and check, like any other investment.
Capital goes where it removes the most risk
Every proposed control is priced against the loss it removes, so risk spending competes on the same terms as any other investment.
An appetite you can actually test
The board’s risk appetite becomes a line on a chart, checked every quarter, instead of a sentence in a policy.
Attention on the few risks that drive the bad years
In the demo company, one scenario drives more than half of the worst 1 in 100 years. Shares like this show where board time pays off.
Honest about uncertainty
Ranges from calibrated people replace false precision. Where experts disagree, the board sees it instead of an averaged score.
Defensible to auditors, lenders and insurers
Every number traces back to the estimates, the people who made them and a calculation that gives the same result when it is run again.
Effort in proportion to the decision
Value of information shows which uncertainty is worth reducing, so the organisation measures only what could change a choice.
For the whole enterprise, built on published method.
Every type of enterprise risk, not only cyber
One method and one curve for the risks a management team actually loses sleep over, so they can be compared, added up and prioritised together.
Rigorous where it matters
- Applies the methods described by Douglas W. Hubbard in How to Measure Anything and by Hubbard and Richard Seiersen in How to Measure Anything in Cybersecurity Risk.
- Calibration training built in, so a 90% range really holds the answer about nine times in ten.
- Every change recorded in a tamper-evident audit trail, and every result reproducible from its stored inputs, so a board report can be checked years later.
A hosted service that people sign in to with their work account.
Measura is delivered as software as a service: hosted in the EU, with nothing for your IT department to install. Sign-in runs through your own identity provider, such as your company’s Microsoft tenant, so access follows the accounts you already manage. Where policy requires it, Measura can run on your own servers instead.
Single sign-on with the account people already have
No new passwords. When someone opens Measura, your identity provider confirms who they are, and Measura opens with their role and only your company’s data.
- Leavers lose access with their account. Close someone’s work account and they can no longer sign in to Measura.
- Five roles decide what each person can do. Board members read, risk owners estimate their own scenarios, auditors inspect the trail.
- Local accounts where single sign-on is not an option, always with two-factor authentication.
Hosted service
StandardWe run Measura for you. Your organisation can start without servers, installation or upgrades to plan.
- Hosted in the EU, with no personal data in logs beyond a user id.
- Each company’s data kept apart in the database itself, not only by the application.
- Daily backups kept for 30 days, and the database can be restored to any point in time.
- Your data can be exported in full, as Excel and JSON, or deleted at any time.
On-premise
On requestFor organisations whose policy keeps risk data inside their own walls, Measura can be installed in your own data centre or private cloud.
- The same software and the same features as the hosted service.
- Your servers, your database and your backup routines.
- Risk data stays inside your network, and sign-in still runs through your own identity provider.
- Installation and updates agreed with your IT department.
See your own risks in money and probability.
Measura is designed and developed by Thomas Bjerre Bojsen, who has extensive experience in quantitative risk management: prioritising and quantifying risk at corporate level, and earlier as a CISO. If the way your organisation reports risk today leaves the board guessing, he would like to show you what the same risks look like on one curve.
Opens your e-mail with a short request ready to fill in: your name, company, role, size and preferred set-up.