Financial models
* Annualized Loss Expectancy (ALE) and Return on Security Investment (ROSI) (include sensitivity ranges).
* Monte Carlo risk (10k simulations) to show loss distribution, not just averages.
* Real Options: stage gates for large programs (pilot → scale), valuing managerial flexibility.
* Value at Risk (VaR) for safety & brand: convert to downtime,