A CFO does not need a list of malware types. A CFO needs to know what a breach costs in euros, and how confident that number is.
The question a threat list cannot answer
Most cyber threat guides stop at naming the problem: phishing, ransomware, insider misuse, a vulnerable vendor. Naming the threat does not tell you what to fund. A CFO’s actual question is different: given the threats a business is exposed to, what is the expected financial loss this year, and what does reducing it by a given amount cost to buy.
That question needs a number with a confidence interval attached to it, not a severity label. This is what a quantified assessment is built to produce: an exposure figure calibrated to two points, P50 and P95, so the range between a typical bad year and a genuinely severe one is visible on the same page.
Where the exposure actually comes from
Every loss estimate traces back through a specific business process, the assets and third parties it depends on, and a defined threat scenario, not a generic industry average. A ransomware scenario against a manufacturing line produces a different number than the same scenario against a marketing database, because the dependency chain and the cost of downtime are different. Treating all ransomware as one line item is how threat lists lose CFOs: the number stops being traceable to a real business impact.
Evidence-labelled inputs matter for the same reason. A figure built from a client’s own control environment should read differently from one built on public information alone. Keeping that distinction visible lets a CFO judge how much weight the number can bear in a budget conversation.
What this changes in a budget cycle
Once exposure is expressed in euros, it can sit in the same table as any other capital allocation decision. A control that reduces expected loss by an amount larger than its cost is a stronger candidate than one justified only by a maturity score improving. This is return on control: the same logic used to evaluate any other investment, applied to security spend instead of exempting it from the comparison.
It also changes what a CFO can ask a security team. Instead of “are we secure,” the question becomes “what does the current exposure figure look like, and what would the next control buy back.” That is a question with a defensible answer.
The practical takeaway
A threat inventory is a starting point, not a deliverable. What a CFO can act on is a quantified figure, tied to a specific scenario, calibrated to a realistic and a severe case, and labelled by how much of it rests on real evidence versus assumption. Screening for that exposure does not require handing over internal access first, so it can happen well before a budget cycle forces the question.