Financial-Risk Evidence
Penetration tests, ISO and SOC 2 certifications, security questionnaires: none of them answer the question your board actually asks. What is this worth in rands? Üsta applies actuarial science to the evidence you have, and works even where the security stack is still maturing.
The annual loss your organisation has a given chance of exceeding. This is the curve a board sets risk appetite against.
The Problem
Cyber sits on the risk register rated High. No one has ever set a budget, a limit or an appetite in Highs.
Credit, market and operational risk all have financial models. Cyber has heat maps. Every other risk at the board table gets a number, and cyber gets a colour. A colour cannot enter the machinery a business already runs in money: budget, risk transfer, risk appetite, procurement, disclosure.
CISOs are expected to speak the language of financial risk at the board table, but they arrive with patch compliance rates and phishing simulation scores. When the CFO asks "are we spending the right amount on security?" there is no analytical basis for the answer.
Boards are now legally accountable for cyber risk: to regulators, auditors, and increasingly shareholders. But the tools available are frameworks designed for IT teams, not financial decision-makers. The sophistication of the accountability has outpaced the measurement.
Every budget cycle, a CISO asks for millions in security spend with no quantified answer to "what does that buy us in risk reduction?" The number gets negotiated on gut feel and seniority. That is how material financial decisions get made on cyber.
Acutely felt by Series B+ and mid-market companies
Enterprise customers and investors now require quantified cyber risk documentation, not just a SOC 2. Growing companies that cannot produce financial-level risk outputs are failing vendor assessments, losing deals, and arriving at fundraising due diligence unprepared. The same gap surfaces at insurance renewal.
Where Üsta Starts
Each of these answers a technical question: what is vulnerable, which controls exist, which standard was met. None answers the executive one. Any that you have will feed the model.
Have none of it yet? The model still runs. Üsta starts from an external view of your organisation, the kind an attacker would assemble without your involvement, combined with a structured profile of your business and control environment.
Evidence you can supply narrows the estimate. It is not a precondition for producing one. Every output states the confidence behind it, so you know what the number rests on.
The Solution
Üsta sits on top of whatever security evidence you have and translates it into financial exposure. The method is actuarial: the same probabilistic, financially rigorous framework used to price insurance and value credit risk, applied to cyber. Not a maturity score, and not a proprietary rating.
We deliver findings in formats your finance, risk, and compliance teams can work with immediately. Outputs are designed to integrate into your existing reporting and governance workflows.
Request a Scoping CallIllustrative output formats. Every figure is calibrated to your organisation.
Who It's For
Credit, market, and operational risk are already governed with distributions and thresholds. Cyber is the exception. Üsta produces exposure in the same terms, ready for risk appetite thresholds, scenario analysis, and regulatory capital submissions such as ORSA or ICAAP.
For CROs & Risk OfficersUnderstand your financial exposure well enough to make informed calls on insurance cover, security investment, and regulatory disclosure. Accountability for cyber oversight now sits with the governing body.
For CFOs & BoardsArrive at the board table with exposure denominated the way every other risk already is. Budget, insurance cover, appetite and reporting then run off one number.
For CISOsProduce the financial-level risk documentation that enterprise customers and investors now require. Stop losing deals to security questionnaires.
For Growth CompaniesWho We Serve
How It Works
30 minutes to assess fit, understand your environment, and outline what the engagement would look like.
A targeted questionnaire maps your control environment across the threat scenarios most relevant to your business.
Your security posture is fed into Üsta's actuarial model, calibrated to the African threat environment and your sector.
Loss distributions, expected value, control ROI, and scenario breakdowns. Delivered in formats your CFO, board, and risk and compliance teams can act on.
What You Receive
Every engagement delivers a single, defensible document: your cyber risk expressed in financial terms, in formats your CFO, board, and risk and compliance teams can act on directly.
Need something specific? We tailor the analysis and reporting to the decision in front of you, whether that is insurance placement, board reporting, vendor assurance, M&A diligence, or regulatory disclosure.
Why Üsta
| Conventional approach | Üsta |
|---|---|
| Maturity scores against a framework (ISO, NIST, CIS) | Financial loss distributions |
| Qualitative heat maps | Actuarial probability models |
| Point-in-time assessments | A living model, recalibrated as your posture evolves |
| Generic industry benchmarks | Calibrated to your specific architecture and threat profile |
| Outputs designed for IT teams | Outputs your CFO, board, and risk and compliance teams can use directly |
How We Work
A cyber risk model is only as good as the business it represents. We bring the actuarial methods; you bring deep knowledge of your own systems, controls, and exposures. We build the model together, so the output reflects how your organisation actually operates, not a generic industry benchmark.
This is how we work: rigorous actuarial methods, applied to real institutions, built alongside the people who know them best.
Built for Africa
Every competitor in the cyber risk quantification space is built for US Fortune 500 companies: calibrated on US threat data, assuming US regulatory frameworks, and requiring mature US-style security tooling stacks.
Üsta is built for institutions regulated under POPIA, South Africa’s data protection law, for African fintech infrastructure, and for the specific threat environment of mobile-first financial services — where cyber and fraud risk are deeply intertwined. Our actuarial model starts from where your organisation actually is, not where a US enterprise is.
No commitment. We will assess fit and explain exactly what the engagement would look like for your organisation.
Request a Scoping Call