Cybersecurity risk scoring calculator · free AI skill

Calculates a quantified cybersecurity risk score for one or more assets using a likelihood × impact matrix methodology, converting qualitative inputs (asset criticality, threat likelihood, vulnerability severity…

Purpose

Convert qualitative risk inputs into a defensible, repeatable risk score using a likelihood × impact matrix — producing a numeric residual risk score, a severity tier, and a ranked remediation priority for each asset or risk scenario. Removes the subjectivity and inconsistency that plague risk registers built on gut feel.

When to Use

Invoke this skill when the user asks to:

Score or quantify a specific cybersecurity risk or vulnerability
Prioritize a list of risks, findings, or assets for remediation
Build or populate a risk register with consistent scoring
Justify remediation spend or resource allocation to leadership
Translate a qualitative assessment (high/medium/low) into a numeric, comparable score
Recalculate residual risk after applying or improving security controls

Inputs Required

Before starting, collect:

Asset(s) and what they hold: System, data, or service being assessed — and what business value or data sensitivity it carries
Asset criticality: How important to operations / data sensitivity (Low / Medium / High / Critical, or describe and the skill will tier it)
Threat likelihood: How probable the threat is to materialize (Rare / Unlikely / Possible / Likely / Almost Certain — or threat actor + exposure context)
Vulnerability severity: Severity of the exploitable weakness (CVSS score if available, or Low / Medium / High / Critical)
Existing controls and their effectiveness: What controls are in place and how well they work (None / Partial / Strong / Robust)
Scope: Single risk or a list of multiple risks/assets to score and rank

If criticality, likelihood, or control effectiveness is described qualitatively rather than tiered, map it to the nearest tier and state the assumption.

Instructions

Step 1: Normalize Inputs to a 1–5 Scale

Convert each qualitative input to a numeric value so the math is consistent across all risks.

Threat Likelihood (L)

1 — Rare: No known threat activity; requires highly unusual conditions
2 — Unlikely: Possible but no current indicators or active targeting
3 — Possible: Plausible; threat actors exist and asset is reachable
4 — Likely: Active threats in this category; asset is exposed or attractive
5 — Almost Certain: Active exploitation observed in the wild or in the environment

Impact (I) — derived from asset criticality and vulnerability severity combined:

Map asset criticality: Low=1, Medium=2, High=4, Critical=5
Map vulnerability severity (or CVSS): None/Low (0.1–3.9)=1, Medium (4.0–6.9)=3, High (7.0–8.9)=4, Critical (9.0–10.0)=5
Impact (I) = round( (asset criticality + vulnerability severity) / 2 ), floored at 1 and capped at 5

Step 2: Calculate Inherent Risk

Inherent risk is risk before controls are credited.

Inherent Risk Score = L × I (range 1–25)

Map to the matrix tier:

1–4 → Low
5–9 → Medium
10–15 → High
16–25 → Critical

Step 3: Apply Control Effectiveness to Get Residual Risk

Controls reduce the realized risk. Apply a reduction multiplier to the inherent score.

Control Effectiveness multiplier:

None — no effective control: 1.0 (no reduction)
Partial — control exists but has gaps: 0.75
Strong — control is well-implemented: 0.5
Robust — layered, tested, monitored: 0.3

Residual Risk Score = Inherent Risk Score × Control Multiplier (round to 1 decimal)

Re-map the residual score to the same tier bands as Step 2. The residual tier is the operative severity — this is what drives prioritization.

Step 4: Assign Priority Ranking

P1 — Critical: Residual score ≥ 16 OR (residual ≥ 10 AND asset criticality = Critical). Act immediately.
P2 — High: Residual score 10–15.9. Remediate within the current cycle.
P3 — Medium: Residual score 5–9.9. Plan and schedule.
P4 — Low: Residual score < 5. Monitor / accept with documentation.

When scoring multiple risks, sort descending by residual score; break ties by asset criticality, then by likelihood.

Step 5: Recommend Action Per Risk

For each scored risk, state:

The single highest-leverage control improvement that would lower the tier (e.g., moving control effectiveness from Partial → Strong) and the resulting recalculated residual score
A treatment recommendation: Mitigate (default for P1/P2), Mitigate or Transfer (P2/P3), or Accept with documented justification (P4)

Step 6: Summarize

Lead with a portfolio view: count of risks per tier, the single highest-priority item, and the aggregate residual risk posture in one sentence.

Output Format

Structure: A summary line, a scoring table (one row per risk), then per-risk recommendation blocks for P1/P2 items
Length: 400–800 words for a single risk; scales with the number of risks scored
Format: Markdown table for scores + short structured recommendation blocks; not prose-heavy
Sections: Portfolio Summary → Risk Scoring Table → Per-Risk Recommendations (P1/P2 first) → Methodology Note
Tone: Risk manager — precise, defensible, quantitative; every score traceable to its inputs

Quality Checklist

Before delivering output, verify:

[ ] Every input is normalized to the 1–5 scale before any multiplication
[ ] Inherent Risk = L × I and Residual = Inherent × Control Multiplier are shown explicitly per risk (the math is auditable)
[ ] Residual score maps to the correct tier band (1–4 Low, 5–9 Medium, 10–15 High, 16–25 Critical)
[ ] Priority ranking is sorted descending by residual score with ties broken by asset criticality
[ ] Every P1 and P2 risk has a specific control improvement and its recalculated residual score
[ ] Any assumed input tiers (where the user gave qualitative descriptions) are stated explicitly

Notes

The likelihood × impact matrix is a qualitative-quantitative hybrid — it produces comparable numbers, not actuarial precision. Treat the scores as a defensible prioritization tool, not a guarantee.
When a CVSS score is provided, use it for vulnerability severity rather than re-rating qualitatively — it is the more rigorous input.
Residual risk is what matters for decisions; inherent risk matters for showing the value of existing controls. Always report both.
A risk that is High inherent but Low residual is a control-success story worth documenting — it justifies continued investment in the control that is working.
For risk acceptance (P4), always recommend documented sign-off by an accountable owner — an accepted risk with no owner is an unmanaged risk.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
<your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

Drag this file into a new chat, or copy and paste its contents
Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills