Tools
Cyber Risk Matrix Calculator: Score Risks on a 5x5 Grid
Many cyber risk assessments, including ones auditors and insurers ask to see, rate each risk the same way: how likely it is (1 to 5) multiplied by how bad it would be (1 to 5), giving a score out of 25. List your risks below, score them before and after your controls, and the calculator ranks them, plots them on a 5x5 heat map and shows how much each control actually reduces. The point of the matrix is the ranking: it tells you which risk to fix first, not just which ones exist.
1. The scoring scale
- Likelihood (in the next 12 months)
- 1 Rare: very unlikely to happen
- 2 Unlikely: could happen, but not expected
- 3 Possible: might well happen
- 4 Likely: probably will happen
- 5 Almost certain: expected, or already happening
- Impact (if it does happen)
- 1 Negligible: minor nuisance, fixed in hours
- 2 Minor: some disruption or cost, no data lost
- 3 Moderate: a day or more of downtime, or limited data exposed
- 4 Major: serious downtime, personal data breach, customers affected
- 5 Severe: threatens the business, large breach, regulator involved
2. Your risks
Inherent = before your controls. Residual = with the controls you have (or plan) in place. If you have no controls for a risk yet, leave residual the same as inherent.
How the score and ratings work
Each risk gets a score of likelihood multiplied by impact, so the lowest possible score is 1 and the highest is 25. Because both sides run from 1 to 5, only 14 scores are actually possible (1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20 and 25). This calculator uses a common banding for a 5x5 matrix:
- Low (1 to 4): accept and review it at your next assessment.
- Medium (5 to 9): manage it, with a named owner and a plan to reduce it when budget allows.
- High (10 to 16): treat it soon; add or strengthen controls and track progress.
- Critical (20 to 25): act now. These are the risks that should be at the top of your board report and your security budget.
Bands are a convention, not a law. Some organisations draw the lines in different places, or weight impact more heavily than likelihood, and your insurer or auditor may use its own scale. What matters is that you apply one scale consistently, so scores can be compared across risks and over time.
Inherent and residual risk
Inherent risk is the score before any controls. Residual risk is what is left once your controls work as intended. The gap between them shows how much a control is doing. Controls usually change one side of the sum more than the other: multi-factor authentication makes an account takeover less likely, while tested offline backups mostly cut the impact of ransomware rather than the chance of being hit. If a residual score is still High or Critical, the control is not enough on its own.
A residual score that is higher than the inherent one usually means a scoring mistake, so the calculator flags it.
Turning the matrix into decisions
A risk matrix tells you the order to work in. To decide whether a specific control is worth its price, put a pound figure on the risk with our annual loss expectancy calculator, and for setting the overall spend, try the cyber security budget calculator. For the full process of identifying assets, threats and owners, read our guide to running a cyber security risk assessment.
This tool runs entirely in your browser. Nothing you type is sent or stored anywhere, so close the page and your list is gone; copy the results into your risk register if you want to keep them.
