ekera For the CFO: arbitrate cyber investments
Arbitrate your cyber investments from explicit economic scenarios. Ekera estimates the financial consequences of outage or attack scenarios, then compares several action plans by cost and expected risk reduction. The data used, the assumptions and the limits of the estimates are visible. The results are a basis for discussion to prioritise investments and follow their implementation.
Request a demoStart with an assessment
What you are looking for
You are not looking for a map of the information system: you are looking for what it takes to make a better investment decision.
- Know what an incident would cost, and place it against the insurance ceiling.
- Compare several action plans by cost and expected risk reduction.
- Be able to examine and justify the figures: their data, their assumptions, their limits.
- Follow the implementation of the investments decided.
What may make you hesitate
| Your question | What Ekera shows |
|---|---|
| “Where do the figures come from?” | From the calculation engine, independently of the language model: same data, same result. The accounting entries file (FEC), which your company can produce, gives revenue and variable costs; the margin is spread across your revenue streams, each counted once. |
| “Are a scenario cost, an annual loss and a measure’s benefit the same thing?” | No, and Ekera keeps them apart: the cost of a given scenario, the expected annual loss (estimated frequency × loss, added up across scenarios) and the effect of measures (the modelled drop in risk if they are carried out). These three figures are not interchangeable; each is given with its definition, its assumptions and its limits. |
| “A precise figure can hide fragile assumptions” | Amounts are given as ranges, from low to high assumptions. The “after the work” results assume the measures are carried out: they are conditional estimates, not a promise of risk reduction. |
| “Who approves which spend?” | A work scenario goes through your approval circuit before anything is written into your tools. The circuit adapts to your organisation: the CFO only above a given amount, for example. Each person approves, refuses or asks for a change from their mailbox or Teams, and decisions are traced. |
What Ekera brings you
Ekera automates part of the analysis and documentation without replacing the people in charge: your teams approve, and decisions stay in your hands.
Useful modules
- Costing in euros : the cost of a scenario, the expected annual loss, the effect of measures.
- Action plan : three budgets, measures compared by cost and estimated effect, an approval circuit.
- Purchasing : quote requests prepared; quotes, orders and invoices read back.
- Catalogue and purchasing : the catalogue of building blocks: what is needed, and with what, linked to NIS2 measures and the calculation.
- Ekera Assurance : documented indicators to show your insurer, with your consent.
- Savings in detail : typical cases, assumptions and sources shown.
A worked example
Fictitious example: Ateliers Morvan
Three figures that must not be confused
The three notions, on the Ateliers Morvan assessment.
| Indicator | Baseline | After the work (simulation) |
|---|---|---|
| Scenario cost: the worst case | €2.4M to €4.9M | €0.9M to €1.8M |
| Scenario cost: a 3-day ERP outage | €0.6M to €1.1M | not assessed in this example |
| Expected annual loss | €150k to €980k | €40k to €260k |
| Effect of measures: maximum outage after an attack | 81% | 34% |
The expected annual loss adds up, for each entry point and each single point of failure, estimated annual frequency × scenario loss. The range runs from low to high assumptions.
Fictitious example: Ateliers Morvan is a fictitious company, and its figures illustrate how the engine works. The indicators depend on the data available, the assumptions made and the scope analysed. The “after the work” results assume the measures are carried out and produce the modelled effects: they are conditional estimates, not a promise of risk reduction.
Next steps
A first 30-minute conversation defines your need, the possible scope and the information required.
Request a demoStart with an assessment
See also : For the CIO · For the CISO.