Cyber Risk Score Calculator

Your cyber risk score reflects how well your organization addresses the security controls that matter most. Each of the 15 questions has a weight. The weights are our own judgement of how much each control reduces the likelihood or impact of a breach: MFA, encryption, patching, incident response and tested backups weigh most. Each question maps to NIST CSF 2.0 outcomes and, where relevant, to the NIS2 Article 21(2) measures; the table below shows those references. For how cyber risk scores work in general, see What Is a Cyber Risk Score?

The score ranges from 0 to 100, where 100 means all assessed controls are fully implemented. A "Yes" answer earns full points for that control, "Partial" earns half, and "No" earns zero. The score is the points earned as a percentage of the 90 available. The category breakdown shows which security domains need the most attention.

The 15 questions and their weights:

This is a rapid assessment designed for quick insights. For a deeper evaluation, our Cybersecurity Maturity Assessment covers 39 controls across 6 NIST CSF functions with maturity-level scoring.

The classic cyber risk equation is risk = likelihood × impact: how likely a threat is to exploit a weakness, multiplied by the harm if it does. Risk management standards such as ISO 31000 and NIST SP 800-30 build on that idea. Applying it properly means rating each risk scenario one by one, which takes days and expert input.

This calculator uses a faster proxy. It does not estimate the probability of an attack. Instead it measures how many of the controls that most reduce likelihood (MFA, patching, training) or impact (encryption, tested backups, incident response) you have in place, weighted by how much each one matters:

Cyber risk score = (points earned ÷ 90) × 100, where Yes = full weight, Partial = half, No = 0

Worked example. A company answers Yes to everything except: patching and backup testing are Partial (losing 3.5 + 3.5 points), and it has no tested incident response plan, no vendor assessment and no security monitoring (losing 7 + 5 + 6 points). It earns 90 − 25 = 65 points. 65 ÷ 90 = 72%, which is Moderate Risk. Fixing the incident response plan alone would add 7 points and lift the score to 80, Low Risk.

Because the score counts controls rather than threats, two companies with the same score can face very different risks: a payment processor and a local bakery need different levels of protection. Read What Is a Cyber Risk Score? for the three common scoring methods (likelihood × impact, control coverage, outside-in ratings) and where each one misleads.

80-100 — Low Risk. Strong security posture across most categories. Focus on maintaining and continuously improving. Consider ISO 27001 certification to formalize your programme. Use our ISO 27001 Gap Assessment to check readiness.

60-79 — Moderate Risk. Decent foundation with notable gaps. You likely have some controls in place but inconsistently applied or partially implemented. Focus on moving "Partial" answers to "Yes."

40-59 — High Risk. Significant gaps that leave your organization exposed. Start with the highest-weighted gaps: MFA, encryption, patching, and incident response.

0-39 — Critical Risk. Fundamental security measures are missing. Prioritize immediately: enable MFA, deploy encryption, start patching, and document an incident response plan. Our Cybersecurity Checklist for Startups provides a step-by-step path forward.