I'm (finally) moving our organization towards more decision-based risk analysis rather than just "it's risk! omg!" Starting with software reviews in the acquisition process.
What are folks using for quantitative modeling? I'm thinking simple models that take into account organizational track record (aka number of x incidents in y timespan), industry track record (average of z incidents) and some kind of weighting factor.
I have a few options. I can hire a contractor to build some excel models for us. I can spend some money on a software tool, with some work if it's more than $1k. Or I can invest in books / pluralsight / etc to teach myself quantitative analysis, which will take longer to get done.
What're you folks using for this kind of stuff?
Second racknard. If you Google Black Friday special, you'll find the page where you can order a VPS with four gigs of RAM for something like $50 a year. It's not a 12-month special either, you can renew it year after year.
I run docker containers there, a Red Dead redemption 2 server, etc. It's really useful commodity server to have around,