The Quantitative Decision Intelligence Layer The Science of Cyber Decisions

Cybersecurity has spent two decades perfecting detection and two years re-discovering quantification. What it has never built is a decision science — a disciplined, falsifiable, mathematically accountable way of turning "we found 40,000 vulnerabilities" into "fund initiative B before initiative A, because it retires $14M of tail risk per dollar spent, and here is the confidence interval."

The Quantitative Decision Intelligence Layer (QDIL) is that science. It does not compete with FAIR, CTEM, NIST CSF, ISO 31000, or COSO ERM — it consumes their outputs as inputs and does the thing none of them were built to do: arbitrate between competing, uncertain, financially-denominated courses of action, continuously, at board speed.

Five commitments define the discipline:

1. Every recommendation is a decision under uncertainty, not a fact. QDIL never emits a bare number — it emits a distribution, a confidence band, and the assumptions that produced them.
2. Appetite is a shape, not a threshold. "High/Medium/Low" is replaced by tolerance curves that move with the business cycle, the regulator, and the balance sheet.
3. Every action competes for the same dollar. Prioritization is portfolio optimization, not a severity-sorted backlog.
4. Recommendations are provenance-bound. A Board can trace any "why" to the models, data, and assumptions that produced it — or refuse to trust it.
5. The discipline is falsifiable. Forecasts made this quarter are scored against what actually happened, and the models that were wrong lose influence.

Two design rules fall out of this diagram and recur through the rest of the document:

• No layer is allowed to collapse uncertainty prematurely. A point estimate that reaches the Executive Surface without its distribution attached is treated as a defect, not a simplification.
• Layer 3 and Layer 4 are peers, not a pipeline. Appetite is not a filter applied after scoring — the Cortex queries appetite continuously, because "is this outside tolerance" is itself an input to what gets modeled next (see § IV, Risk Elasticity).

The most common failure in "cyber risk quantification" is treating one model — usually a single Monte Carlo loss simulation — as the whole discipline. EXORADI treats quantitative modeling as an orchestrated fabric: a director model routes a question to the technique built to answer it, then reconciles the outputs. The routing logic itself is a governed artifact (versioned, testable, auditable), not a judgment call left to an analyst.

Traditional ERM treats appetite as a static statement ("we accept low risk in category X") and tolerance as a fixed threshold under it. Both assumptions break in practice: appetite changes with the fiscal quarter, and a threshold that made sense at $50M revenue is wrong at $500M. EXORADI models appetite as a dynamic, multi-dimensional boundary — closer to a control system's set-point than a compliance checkbox.

The Cortex is a five-stage pipeline. Each stage produces an artifact that the next stage consumes and that a human can inspect separately — this is what makes "why" answerable after the fact, not just at the moment of recommendation.

Technical policy engines evaluate signals (CVSS > 9). EDPL evaluates decisions — financially denominated, appetite-aware, and always resolving to a recommended action plus a rationale, never a bare boolean. A policy has four clauses:

• WHEN — the decision class this policy governs.
• EVALUATE — one or more conditions over Model Fabric and Appetite Fabric outputs.
• THEN — the recommended action, ranked if multiple policies fire.
• CONFIDENCE — the minimum model confidence required before the policy is allowed to auto-fire versus merely advise.

A risk score answers "how bad is this." EDS answers "how good is doing something about it, right now, compared to the alternatives." It is computed per candidate action (patch / defer / isolate / insure / accept / redesign), not per vulnerability — the same exposure can produce a high EDS for "insure" and a low EDS for "patch immediately" if the numbers say so.

Formulated as a constrained multi-objective optimization over the candidate initiative set N, with continuous funding fraction xi ∈ [0,1] (partial funding permitted, since most controls have a minimum-viable tranche and diminishing returns beyond it):

Two refinements distinguish EPOM from a textbook knapsack:

• Marginal Risk Reduction Value. Each initiative's risk reduction is modeled with diminishing returns, U(r) = 1 − e−λr, so the optimizer correctly values a second, smaller investment in an already-well-controlled asset less than the same dollar spent on an untouched one.
• Efficient frontier, not a single answer. Because Expected Business Value, Risk Reduction, and Strategic Alignment genuinely trade off against each other, EPOM returns a Pareto frontier — the Board picks a point on the curve, and the choice itself is logged as a governance decision.

Every Cortex output writes a Decision Ledger entry — an immutable record answering six questions before it is allowed to reach the Executive Surface:

Three UI commitments follow directly from the science, not from dashboard convention:

• Every number on the surface is a link into its Decision Ledger entry — there is no such thing as an unexplained figure in the executive view.
• Confidence is always co-located with the value it qualifies (a pill, not a footnote) — a wide band changes what "top-ranked" means at a glance.
• The frontier, not a ranked list, is the default portfolio view — reinforcing that "priority" is a chosen point on a curve, not a fixed order.

• Causal inference for control efficacy — moving from correlational control-efficacy estimates to causal effect sizes using quasi-experimental design across the customer base.
• Federated risk benchmarking — cross-organization tolerance and loss calibration without sharing raw loss data, via secure aggregation.
• Reinforcement learning for policy tuning — treating EDPL weight calibration as a continuing bandit problem scored against realized outcomes rather than a quarterly manual re-weighting.
• Formal verification of decision policies — proving an EDPL policy set is free of contradictory recommendations before it reaches production.
• Adversarial calibration — incorporating live threat-actor behavior change (Stackelberg response) directly into exploit-probability priors rather than periodic manual updates.
• Behavioral calibration of executive risk perception — measuring the actual loss-aversion coefficient of a given leadership team and correcting EDS's Strategic Alignment term for it, rather than assuming rational risk-neutrality.