# Exposure Risk Quantification

FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible...

- Repository: https://github.com/elementalsouls/Claude-OSINT (2943 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-20
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-OSINT --skill exposure-risk-quantification -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-OSINT --skill exposure-risk-quantification -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-OSINT --skill exposure-risk-quantification -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-OSINT --skill exposure-risk-quantification -g -a gemini-cli -y`

## Description

FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownership-aware factors: exposure/threat/impact), an ownership + proof demotion cap so unproven or weakly-owned findings can't inflate the number, a $-denominated FAIR loss-magnitude estimate (IBM/Ponemon per-record cost bands, cross-source record dedup, threat-factor annualization), attack-path amplification (curated red-team chain catalog + generic graph-walk engine, with a kill-chain vs shared-fate honesty gate), and a board-ready one-pager deliverable (hero $ + letter grade + top-3 findings + top attack path + the ask). Extends osint-methodology's severity rubric and client deliverable templates with quantification. Passive analysis only -- operates on findings already collected, no target traffic, no API keys. Use when asked to score risk, quantify exposure, estimate breach cost, build a board report, translate technical findings to dollars, or explain why a grade or dollar figure came out the way it did.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Exposure Risk Quantification, FAIR Scoring, $-Loss, and the Board Deliverable

> Companion skill: `osint-methodology` (the "how to think" recon skill, see its §9 severity
> rubric and §16 client deliverable templates). This skill is the "how to quantify and
> present" layer on top of a finished recon pass: it takes findings the methodology skill's
> pipeline already produced and turns them into a number a board will act on.

## 0. When to Use / When NOT

**Use this skill when:** you have a completed set of recon findings (from any engagement,
not just one tool's output) and need to (a) compute a defensible 0, 100 + A, F risk score,
(b) estimate a $-denominated loss range, (c) rank attack-path chains by exploitability, or
(d) assemble a board/exec one-pager. Also use it to *explain* a score, "why did this grade
come out D and not F" is exactly what §7 is for.

**Do NOT use this skill when:** you still need to go collect findings, that's
`osint-methodology` (methodology) / `offensive-osint` (arsenal). This skill does not probe
anything; it has nothing to say until a recon pass has already produced findings, assets,
and (ideally) ownership/proof annotations.

---

## 1. Posture: Passive Analysis, Not New Recon

Every computation in this skill is a **pure function over findings + assets you already
hold**, no network calls, no new probes, no target traffic. The reference implementation
(`reporting/{risk_score,loss_model,board_report,board_render,attack_paths,
attack_graph,owner_confidence,proof}.py`) is explicit about this: `risk_score.py` docstring
calls itself "Pure compute over `scan.db`, no network, no schema change"; `loss_model.py`
calls itself "Pure, no network"; `attack_graph.py` calls itself "Pure + offline."

The rest: https://github.com/elementalsouls/Claude-OSINT/blob/HEAD/skills/exposure-risk-quantification/SKILL.md