Methodology
Where the number comes from.
Nothing here is a black box. The method is public because a number the board cannot audit is worth nothing in a meeting.
01The scenario
Seven scenarios, not a threat list.
The unit of analysis is the loss scenario: an event with a beginning, a middle and a bill. Ransomware halting operations is a scenario; "malware" is not. All come out in Brazilian reais; corporate account compromise raises the frequency of the others, and unsanctioned AI only gets a value when traffic is observed.
- Every scenario has frequency and impact estimated separately.
- Frequency comes from the history of the company itself when there is one; otherwise from the sector and size reference, adjusted by the signals observed.
- Impact separates primary loss (whenever it happens) from secondary loss (only if someone outside reacts).
02The range
Simulation, not mental arithmetic.
Every scenario runs thousands of simulations and comes out as a distribution, not as a number. What appears on screen is the range from P10 to P90, the chance of a severe incident in the year and the cost of a bad year.
- With no data, the scenario shows as unmeasured with the reason, never as zero.
- A point estimate is forbidden on every surface of the product and of this site.
- The scale is always the same between before and after, so the comparison stays honest.
03The confidence
The number carries the quality of its own proof.
Confidence is not an opinion: it is a function of how many disciplines have a connected source for that scenario, which proof tier each control reached, and how old the evidence is.
- Stated, evidenced and validated weigh differently, and only a test validates.
- Expired evidence stops counting as proof, with nobody touching it.
- Indene tells you which next connection raises confidence the most.
04The limits
What the method does not do.
An honest method declares where it stops. Indene does not predict incidents, does not replace the security team and does not issue certificates.
- It is not a forecast: it is an annual loss distribution under the conditions observed.
- It does not replace GRC, red team or independent audit; it organises and proves their work.
- With no connected source the number still exists, but confidence is low, and that is written on the screen.