Quantify — not colour-code
What is your risk actually worth in dollars?
Most GRC tells you red / amber / green. A solo operator can’t fix everything — you need to know which gaps carry the most loss exposure, so you spend your limited hours where they move the number. Here’s a rough illustration; the real one is computed from your own observed posture.
Illustrative annual loss exposure
$400K/yr
plausible range $240K – $560K
A modelled illustration — computed from published reference classes (Cyentia IRIS, Verizon DBIR, IBM), not a promise. “Material” = a loss big enough to matter (roughly six figures, or about 1% of revenue). Inside GRC Solo the number is computed from your own observed control posture across ~20 threat scenarios and re-computed as reality changes — the figure you’d defend to a board, not a form.
Why the real number is different
The public estimate uses published benchmarks. Inside GRC Solo, the number is observed, not assumed: it reads your actual control state from your connectors, weights each gap by the loss it carries, and re-computes as reality drifts. That’s what turns “we have 40 open findings” into “these three cut the most exposure — do them first.” Risk you can defend to a board, and prioritise as one person.