A well-known retailer has experienced a massive credit card breach. The retailer had gone through an audit and had been presented with a potential problem on their network. Vendors were…

Residual risk calculation measures the risk that remains after existing controls are applied, not the monetary value of the specific unmitigated vulnerability that was identified.

A cost/benefit analysis compares the expense of implementing a control against its projected benefit but does not independently quantify the monetary value of the threat itself.

Quantitative Risk Analysis uses metrics such as Single Loss Expectancy (SLE), Annual Rate of Occurrence (ARO), and Annual Loss Expectancy (ALE) to express risk in concrete dollar amounts. This directly satisfies the requirement to prove the monetary value of the AD-to-DMZ pivoting vulnerability, giving decision-makers a financial figure to compare against the cost of remediation. Unlike qualitative methods, quantitative analysis produces specific numerical outputs that support business-case justifications for remediation spending.

Qualitative risk analysis assigns descriptive ratings such as high, medium, or low to risks rather than the specific monetary values needed to prove financial impact.