When to call us

You need to justify the security budgetNot "we need it" but expected loss and what the spend reduces.
How much cyber insurance cover to buyCover and deductible based on your own loss estimate.
Several candidate measures, one budgetWhich ones reduce the most for the money.
Risk has to be reported to the board or head office in numbersIn the format of the group's risk framework.
A questionnaire asks whether you assess riskA reasoned analysis, not a colour-coded table.
After an incident, what a repeat would costSize the investment against what actually happened.

Approach and method

  • Scenario selection:Three to five scenarios that can happen in your business: ransomware, mailbox takeover and bank-detail fraud, personal data breach, website outage.
  • Frequency:A range estimated from public industry data, Japanese cases and your own situation (controls in place, past events).
  • Loss:Recovery, lost revenue during the outage, notification and legal costs, compensation to customers, staff time, itemised and using your own figures (revenue, headcount, days to recover).
  • Measures:For each candidate, how much it lowers frequency or loss, compared with its cost.
  • Method:Based on the FAIR approach, with the reasoning and ranges shown. Results are ranges, not point values.

Estimates are called estimates. Frequency and loss cannot be known exactly. The report shows the reasoning and the range, and what changes if an assumption changes. We do not add decimal places to look precise.

How an engagement runs

  1. Scenario selectionInterviews with management and IT settle three to five realistic scenarios.
  2. Data collectionYour figures (revenue, headcount, recovery time, existing controls) plus industry data and Japanese cases.
  3. QuantificationFrequency and loss ranges per scenario and the expected annual loss.
  4. Comparison of measuresSavings and cost per candidate measure, ranked.
  5. ReportManagement report and briefing; board or head-office material where needed.

Deliverables

  • Risk analysis report in English, Japanese or both: scenarios, assumptions, reasoning, ranges, expected annual loss
  • Cost-benefit table of measures
  • Management summary and briefing
  • Loss estimate for sizing cyber insurance cover where needed
  • A worksheet you can recalculate with different assumptions

Indicative pricing

Starting pointFrom about JPY 350,000Indicative for three to five main scenarios and a management report. The price depends on the number of scenarios, sites and business units, and the data collection involved. Scope and price are fixed before work starts.

Frequently asked questions

What does it cost?

Three to five main scenarios start at about JPY 350,000, depending on the number of scenarios and business units and the data collection involved.

Can the numbers be trusted?

They are reasoned ranges, not point values. What a decision needs is the order of magnitude, and the report shows how the result moves when an assumption changes.

What data do you need?

Revenue, headcount, the effect of the main systems stopping, days to recover, existing controls and past events. We collect it in interviews, so preparation is minimal.

Can it be used for cyber insurance?

Yes, to think through cover and deductible from your own loss estimate. CS2 is not an insurer; the product choice is made with your broker or insurer.

Can you work in both English and Japanese?

Yes. Meetings, reports and management briefings are available in English and Japanese, so a foreign head office and the Japanese team can work from the same findings.

Can it use our vulnerability assessment results?

Yes. Feeding the findings into the frequency estimates makes the ranking of measures more concrete.

Tell us the one scenario that worries you most.

We will size its loss in the first meeting.

Contact