Onam
Risk Quantification

What could your riskiest findings cost if they were exploited?

CVSS scores tell you severity. A loss estimate tells you what is on the table.

Onam's Risk engine gives every critical and high finding a FAIR-style loss estimate — a low, likely and high figure in dollars — built from inputs you can see and tune, and raised when the finding sits on an attack path.

See it in my cloud Read the docs
9,853
posture rules
7
cloud providers
549
cloud services
78
compliance frameworks
Why it mattersHow it worksWhat you getSee it liveFAQ
Why this matters

Security is asking for two more headcount and a bigger tooling budget.

The CFO asks: what does that spend actually prevent? Nobody has a number. A wall of CVEs and a stack of CVSS scores is not an answer a board can approve. Without a loss estimate, security lives on a hunch — and hunches lose budget fights every year.

The risk of not knowing

If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.

Re-checked on every scan, not once a quarter
How does it actually work?

The mechanism, not the marketing

  1. 1

    Each critical and high finding is modelled FAIR-style: how likely a loss event is, times how large the loss would be.

  2. 2

    Likelihood starts from the exploit probability (EPSS) and how exposed the resource is — a public resource counts for more than an internal one.

  3. 3

    Loss size starts from the records at risk times a per-record breach cost for your industry, then a multiplier for how sensitive the data is, and a multiplier for how valuable the asset is, with crown jewels highest.

  4. 4

    Where the data falls under a regulation — GDPR, HIPAA, PCI DSS, SOX, CCPA and others — the single strictest regulatory multiplier is applied (they never stack) and an estimated fine is added.

  5. 5

    Attack-path context raises the estimate: a finding on an attack path, on a choke point, on many paths, or on a resource an active threat actor is touching gets a higher likelihood, and a large blast radius raises it further.

  6. 6

    The result is a low, likely and high dollar figure per finding, rolled up into total exposure, the top scenarios, a breakdown by engine and a trend over time.

What do you actually get?

Specific outputs, measurable outcomes

FAIR-style modelLoss event frequencyLoss magnitudeEPSSCrown-jewel multipliersData sensitivityBlast radiusAttack-path signalsGDPRHIPAAPCI DSSSOX
FAIR-style loss estimate per critical and high finding
low, likely and high
Regulatory exposure for GDPR, HIPAA, PCI DSS, SOX and other regimes
Higher estimates for findings on attack paths and choke points
Crown jewel and data-sensitivity multipliers
Top scenarios ranked by likely exposure
Exposure broken down by engine, and trended over time
Tunable inputs
per-record cost, revenue and sensitivity multipliers per tenant
See it live

Risk Quantification in the real console.

A recreation of the Onam console with sample data — the screens and finding types your team works with.

Risk — FAIR-style estimate
Export Risk Report
$0.0M
Likely exposure
0
Risk Score
0
Crown Jewels
$2.4M–$8.7M
Likely–max range
Top Risk Scenarios (FAIR-style)
Risk in dollars, not just scores
FAIR-style loss estimates per finding — $5.1M likely exposure across 6 scenarios and 3 crown jewels
Clip length
11s
Data
Demo account
FAQ

Questions we get a lot

FAIR (Factor Analysis of Information Risk) breaks risk into how often a loss event is likely to happen and how large the loss would be. Onam follows that structure to give each critical and high finding a dollar estimate, so findings can be compared in the same units a board uses for other business risk.
Ready to see it live

Ready to see Risk Quantification in your cloud?

Connect a read-only role in three minutes. Your first findings surface in under five.

Book a live demo →See pricing
Related capabilities
What is cloud risk quantification?What is a choke point?Attack Path AnalysisComplianceCSPM — PostureCDR — Detection