The Total Economic Impact™ Of Mastercard Cyber Quant

Staff Efficiency On Risk Assessment

Evidence and data. Before Cyber Quant, interviewees described cyber risk assessment as a highly manual, labor‑intensive process that required significant coordination across teams and months of effort to complete. Assessments were largely spreadsheet‑based, introducing challenges to data aggregation, version control, and repeatability. As a result, security teams were constrained in how often they could assess risk and how broadly they could apply those assessments across the organization.

• With Cyber Quant, interviewees described moving from ad hoc, manual workflows to a structured, tool‑based assessment process that reduced the operational burden on security staff and made assessments more manageable. By centralizing data collection and standardizing assessment inputs, teams were able to complete assessments with less manual coordination and fewer people. The cybersecurity manager in consulting said: “Imagine you and I answered the same questionnaire. Me with my link, you with your link, and Cyber Quant knows that you said yes and I said no. Before, I needed to do a merge of the spreadsheet to see this. It was a lot of work.”

• Assessments were also more frequent, as the cybersecurity manager in consulting noted: “If you do an assessment today, but the threat changes in three months because every day the vulnerabilities change in the world, you receive an email notification. So if you receive an alert, you can take action or do another assessment. It’s a way to see things more frequently.”

• This repeatable, platform‑based approach with Cyber Quant enabled security teams to conduct risk assessments with greater efficiency and less disruption to day‑to‑day operations. The information security manager in financial services said, “Today, we can make an alignment of the software installed in the computers to missing controls in a few minutes.”

• The CISO in financial services explained: “Before, our assessments were a much bigger project because we needed to bring people in to do the assessments. Then we needed to schedule a lot of meetings where those assessors would sit with each of us on the team to go through configurations. There were many hours of system review. With Cyber Quant, even though I need to run those scripts, if they are running smoothly, it takes a lot less time.” The interviewee also mentioned: “The questionnaire part is easy. Even though it’s like 500 questions, it's still a very easy process to complete.”

• The shift allowed organizations to move away from infrequent, resource‑heavy exercises toward a more sustainable assessment model supported by fewer staff hours and reduced manual effort. The assessments were also holistic. The CISO in financial services said: “Before, we could only look at half our servers in each assessment, so we were missing the overall risk assessment for the entire company. When we started to work with Cyber Quant, we got a complete overview instead of just going over one system at a time for regulatory needs. There is even an overall risk score, which is a very good indicator and which I assume throughout the years we can use to show improvement based on the same perspective.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Before Cyber Quant, the composite dedicates 1,000 hours per assessment.

• With Cyber Quant, the composite reduces the hours required by 50%.

• The average fully burdened hourly rate for an FTE conducting the assessment is $62.50.

Risks. The impact of this benefit will vary among organizations based on the following factors:

• The number of assessments and resources dedicated before Cyber Quant.

• Assessment scope and organizational maturity.

• Platform familiarity across teams and stakeholders.

Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $148,000.

Staff Efficiency On Audit Findings Response

Evidence and data. In addition to improving front‑end risk assessment efficiency, interviewees described how Cyber Quant helped reduce staff effort required to respond to audit findings after assessments were completed. Prior to Cyber Quant, teams often documented audit and risk findings in static reports or spreadsheets, requiring security teams to manually trace findings back to evidence, controls, and remediation actions during follow‑up reviews.

• Interviewees explained that Cyber Quant provided a more structured and reusable set of assessment outputs, which could be referenced when responding to audit inquiries or internal reviews. Rather than recreating evidence or re‑explaining risk posture for each review cycle, teams were able to rely on existing assessment artifacts to support discussions and remediation planning.

• With evidence already assembled in the platform, security teams spent less time chasing files and revalidating decisions after findings were issued and more time driving remediation workstreams to closure.

• Interviewees also emphasized that Cyber Quant outputs were easier to reuse and explain internally, which reduced back‑and‑forth with stakeholders during remediation discussions. The CISO in financial services said: “Cyber Quant is a very good tool for management and representation of the data. After each assessment, there is a very clear presentation of the data that is being collected, the risk score, who our potential attackers are, what the attack method is, and so on. It’s very convenient for me to represent those data.”

• As a result, organizations were able to respond to audit and risk findings more efficiently, with clearer prioritization and less staff time spent interpreting or defending assessment results. Interviewees associated this downstream efficiency with the structured outputs provided by Cyber Quant during the assessment phase, without changing the number of audits or findings themselves. The cybersecurity manager in consulting said: “Now I can use my time and the time of my team to get more projects with customers, not internal projects. When I get more projects, I can increase revenue, margin, and the chances to promote my team.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Before using Cyber Quant, two people spent three months on external audit response.

• The audit response took six months before Cyber Quant.

• Before Cyber Quant, the external audit results in 20 findings.

• After Cyber Quant, the external audit results in nine findings.

• We assume that response effort scales with the number of findings; reducing findings from 20 to nine reduces response effort by 55%.

• The composite conducts four external audits per year.

Risks. The impact of this benefit will vary among organizations based on the following factors:

• The organization’s response effort per finding before Cyber Quant.

• The organization’s technology investments and decision-making with Cyber Quant.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $320,000.

Improved Security Investment Decisions

Evidence and data. Prior to adopting Cyber Quant, interviewees described making cybersecurity investments without consistent, enterprisewide validation of whether those investments would materially reduce risk. Decisions were often driven by regulatory pressure, best‑practice recommendations, or localized findings rather than a quantified view of overall exposure. As a result, organizations faced the risk of investing in technologies without clear evidence of their impact on the organization’s risk posture.

• After implementing Cyber Quant, interviewees explained that they used the platform as a validation mechanism to assess whether potential or planned technology investments were aligned with their actual risk profile. Rather than automatically proceeding with new tool purchases, security teams used Cyber Quant to determine whether existing controls were sufficient or whether a proposed investment was warranted. The information security manager in financial services said, “It’s important for us that the technology that we’re in proof of concept or in validation for is supported by Cyber Quant.” The interviewee mentioned that one tool they were evaluating didn’t meet those standards, so the organization avoided that investment.

• This validation step helped organizations avoid or defer technology purchases that Cyber Quant analysis showed would not meaningfully reduce risk. Interviewees emphasized greater confidence in deciding whether to invest at all. The information security manager in financial services said, “We made some investments from 2021 to 2024, and the level of the risk went down.”

• By tying technology decisions to quantified risk assessments, organizations reduced the likelihood of spending on misaligned or low‑impact security tools. Cyber Quant helped avoid or defer technology spend by helping teams substantiate when additional investments were unnecessary and by reinforcing focus on controls most relevant to their regional, regulatory, and business risk context.

Modeling and assumptions. Based on the interviews, Forrester assumes that the composite avoids $20,000 in technology spend in Year 1 by using Cyber Quant assessment outputs to validate planned purchases.

Risks. The impact of this benefit will vary among organizations based on the organization’s planned or proposed technology investments before Cyber Quant.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $15,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Improved executive and business communication. Before implementing Cyber Quant, interviewees described difficulty communicating cyber risk beyond technical teams. Risk assessments produced reports and findings, but these often lacked a clear, business‑level narrative that executives could easily interpret or use to guide decisions. As a result, security leaders spent time explaining why certain issues mattered and justifying priorities in nontechnical terms. After adopting Cyber Quant, interviewees reported that assessments became easier to communicate to executive and business stakeholders because risk was presented in a more structured and business‑relevant way. In particular, the ability to quantify cyber risk in financial terms helped bridge the gap between technical detail and business understanding and to communicate risk in terms that business and executive stakeholders could understand. Rather than debating individual technical weaknesses, executives were able to focus on what mattered most from a business perspective. This improved alignment helped security teams drive clearer discussions around priorities and next steps, reducing the time spent reconciling security recommendations with business expectations.

• Better risk-based prioritization of controls. Interviewees also described a meaningful shift in how security teams prioritized controls after adopting Cyber Quant. Prior to implementation, teams found it difficult to determine which actions would have the greatest impact on overall risk. With Cyber Quant, organizations were able to assess risk in a broader business and regional context, which helped them focus remediation efforts on the controls most relevant to their actual threat environment. Rather than treating all findings equally, teams could distinguish between high‑impact and lower‑impact issues. As a result, security resources could be directed toward areas most likely to improve the organization’s risk posture.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Cyber Quant and later realize additional uses and business opportunities, including:

• Ability to increase assessment cadence or scope in the future. Interviewees mentioned that because assessments were no longer constrained to long, infrequent cycles, this created the option to increase assessment frequency, compare results over time, or expand scope without linear increases in effort. The cybersecurity manager in consulting mentioned: “If I need to see how cybersecurity is evolving, I do another assessment and compare the two. I usually do two or three in a year.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).