Loss magnitude is the estimated financial impact of a cyber event. It describes how much an organization could lose if an incident occurs, including costs such as investigation, recovery, business interruption, legal obligations, and customer response. It is distinct from loss frequency, which estimates how often an event may happen.
In cyber risk quantification, loss magnitude helps compare exposures and evaluate security investments in financial terms. Models may estimate a range rather than a single amount because outcomes depend on factors such as affected systems, duration, and response costs. These estimates are only as reliable as their data and assumptions: incomplete inventories or outdated inputs can create misleading precision. Security teams should document those assumptions and use the result to inform decisions, not treat it as a guaranteed prediction.