Reality Check · Method
How the numbers are made
The Reality Check is a self-assessment. It runs on fictional assets and on what you tell it. Nothing here is measured from your systems. This page explains the scoring, the calculations and the limits.
Engine versions are listed here when the page loads.
Your answers
Each question about your organization takes one of five answers: Yes, Partial, No, Unknown or Not applicable.
- Unknown is a gap in coverage. It lowers coverage but never counts as a failure.
- Not applicable is left out of the count entirely.
- Controls you try in the simulation are stored separately and never change your answers. Your assessment only changes when you answer a question or press Apply to my assessment.
Scores and coverage
Each area gets a score from 0 to 100 in steps of 5. The score is based only on the questions you answered (Yes, Partial or No), weighted by importance. Coverage is shown next to it: answered questions out of applicable questions. A high score with low coverage means you've answered too little to rely on it. Areas are never averaged into a single total.
| Score | Reading |
|---|---|
| 0–25 | Exposed: Most answered controls are absent. Expect incidents in this area to be found late and handled manually. |
| 30–50 | Partial: Some controls exist but are incomplete or informal. Gaps are likely to be where incidents start. |
| 55–75 | Established: Most controls exist. Remaining gaps are specific and can be closed with targeted work. |
| 80–100 | Strong: Controls are in place across the answered questions. Verify with evidence before relying on them. |
Three kinds of number
- A Illustrative episode totals
- The live cards during a scenario. They describe what happens in that fictional episode. They are not a forecast for your organization. Replaying an episode rebuilds them, so nothing is added twice.
- B Organization estimates
- These come from your inputs on the assumptions page. Each estimate shows its formula, low/base/high range and monthly figure. The annual figure is a run-rate (monthly × 12), not a prediction. If an input is unknown, the estimate is left out and replaced by what to measure.
- C Potential exposure in one scenario
- The possible impact if one specific scenario happened. It is not an expected annual loss, and it is never added to the recurring estimates.
A worked example
20 workers × 15 minutes a day × 22 working days ÷ 60 = 110 hours a month. Valued at €40 an hour, that is €4,400 of capacity. That's time that could go to other work. It isn't guaranteed cash savings.
- Direct spend (compute, model calls, storage) is kept apart from staff time.
- The same waste is counted only once, even when two findings point to it.
- A failed task and its retries are not counted twice.
- An exact headcount only scales the inputs that are per person.
- Every effect of a control (for example "approval reduces exposure") is a stated, versioned assumption. None is presented as measured evidence.
Product suggestions
Findings map to needs, and needs map to capabilities the products have today. You get the strongest fit and, at most, one secondary fit, each with the findings behind it. Sometimes the answer is No immediate product recommendation or Validate these facts first. An option using existing tools is always listed. Planned features are never offered as available.
Limits
- No scan and no connection to your systems. The answers you give are taken as stated.
- Default values are illustrative. They are not benchmarks for your sector.
- The simulation shows cause and effect. It cannot prove that a particular control would stop every threat.
- Reports use templates and the deterministic calculations above. Your contact details are never sent to an external AI service.