Exposure Risk Quantification
FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible...
Install
npx skills add elementalsouls/Claude-OSINT --skill exposure-risk-quantification -g -a claude-code -y- Repository
- elementalsouls/Claude-OSINT2.9k
- Category
- Security
- Updated
- 15d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownership-aware factors: exposure/threat/impact), an ownership + proof demotion cap so unproven or weakly-owned findings can't inflate the number, a $-denominated FAIR loss-magnitude estimate (IBM/Ponemon per-record cost bands, cross-source record dedup, threat-factor annualization), attack-path amplification (curated red-team chain catalog + generic graph-walk engine, with a kill-chain vs shared-fate honesty gate), and a board-ready one-pager deliverable (hero $ + letter grade + top-3 findings + top attack path + the ask). Extends osint-methodology's severity rubric and client deliverable templates with quantification. Passive analysis only -- operates on findings already collected, no target traffic, no API keys. Use when asked to score risk, quantify exposure, estimate breach cost, build a board report, translate technical findings to dollars, or explain why a grade or dollar figure came out the way it did.
Exposure Risk Quantification, FAIR Scoring, $-Loss, and the Board Deliverable
Companion skill:
osint-methodology(the "how to think" recon skill, see its §9 severity rubric and §16 client deliverable templates). This skill is the "how to quantify and present" layer on top of a finished recon pass: it takes findings the methodology skill's pipeline already produced and turns them into a number a board will act on.
0. When to Use / When NOT
Use this skill when: you have a completed set of recon findings (from any engagement, not just one tool's output) and need to (a) compute a defensible 0, 100 + A, F risk score, (b) estimate a $-denominated loss range, (c) rank attack-path chains by exploitability, or (d) assemble a board/exec one-pager. Also use it to explain a score, "why did this grade come out D and not F" is exactly what §7 is for.
Do NOT use this skill when: you still need to go collect findings, that's
osint-methodology (methodology) / offensive-osint (arsenal). This skill does not probe
anything; it has nothing to say until a recon pass has already produced findings, assets,
and (ideally) ownership/proof annotations.
1. Posture: Passive Analysis, Not New Recon
Every computation in this skill is a pure function over findings + assets you already
hold, no network calls, no new probes, no target traffic. The reference implementation
(reporting/{risk_score,loss_model,board_report,board_render,attack_paths, attack_graph,owner_confidence,proof}.py) is explicit about this: risk_score.py docstring
calls itself "Pure compute over scan.db, no network, no schema change"; loss_model.py
calls itself "Pure, no network"; attack_graph.py calls itself "Pure + offline."
