Pricing your bad days and how to build an economic model for security decisions Ivan Milenkovic, VP Risk Technology EMEA at Qualys, explains how security leaders can build an economic model that puts money behind their decisions. He suggests starting with a few loss scenarios, then working down to the assets that drive them. He covers how to rank fixes by value at risk, what CFOs expect to see, and how to show the worth of incidents that never happened. He also looks at how one model can serve both the board and cyber insurance underwriters. Most security teams can tell a board how many vulnerabilities they closed last quarter, but very few can say what that work was worth in money. When a CISO sits down to build an economic model for the first time, where do they usually go wrong? An…