A precise & unambiguous mathematical definition of Cyber-Risk is developed, yielding an experimentally validated solution demonstrating ‘How to Predict & Measure Cyber-Risk’ for any Internet Connected Information System (ICIS) to greater than 98.07% accuracy. Moreover, it is shown that the solution holds for all scales of ICIS, from an Application level to an Enterprise level. In addition, it is shown that Test Effort Estimation (TEE) quantifies Cyber-Confidence, which in turn quantifies Cyber-Risk. Hence, TEE is a Mission Critical Activity (MCA) when formulating Cyber-Risk Management Strategies & may be utilised prior to project commencement, in-flight or post facto as an assessment &/or auditing tool. The TEE Model Construct developed is a statistical based methodology whereby the evaluations/decisions made, result in the contraction or expansion of the ‘z-Score’ associated with an infinite population of database records. The primary advantage of this approach is that very little information is required client-side at the engagement stage in order to produce peer acceptable estimates of the required test effort, & to accurately predict & measure the associated Cyber-Risk. This approach empowers clients & service providers to precisely define whatever level of Cyber-Risk is to be contractually delivered, capable of being absorbed, or prepared to be absorbed by consensus. With the aid of a decision table, estimators are able to articulate & convey to the appropriate authorities, various levels of Cyber-Risk commensurate with the available resources. The TEE Model Construct developed, presents an experimentally verified methodology, cognizant of commercial realities, yielding the following key advantages; (i) it requires minimal inputs, (ii) it has a scientific foundation, (iii) it facilitates operational decision-making, (iv) it quantifies Risk Based Testing (RBT), (v) it is simple, robust, flexible, consistent, reusable & transparent, (vi) it is capable of scaling a projected solution from a known solution, (vii) it embraces Continuous Improvement Processes (CIP’s), (viii) it confines perceptual subjectivity predominantly to three variables & (ix), it commercially exists as an off-the-shelf product.
