Tool_04 // Asset triage
Attack Surface Priority Matrix.
Prioritize exposed systems with a weighted exploitability model and sequence remediation by risk reduced per engineering hour.
Portfolio annual risk
$210,238
Based on ARO x SLE using $1,370/h,10h severe downtime ($13,699 per event), data multiplier 1.17x, threat multiplier 1.00x.
Critical / High assets
1 / 2
Top asset concentration
30%
Sprint risk reduction
$93,811
| Rank | Asset | Score | Priority | Annual risk | Hours | Risk / hour | Sprint action |
|---|---|---|---|---|---|---|---|
| #1 | Employee VPN Portal | 3.96 | High | $62,853 | 21h | $2,993 | Remediate now |
| #2 | Production API Gateway | 4.76 | Critical | $83,726 | 34h | $2,463 | Remediate now |
| #3 | Legacy Admin Console | 3.94 | High | $63,659 | 42h | $1,516 | Queue next sprint |
Remaining sprint capacity: 35h. Prioritize by annual risk reduction per engineering hour to maximize measurable risk burn-down.
Model assumptions, not benchmarks
Annual risk per asset = Annualized Rate of Occurrence × Single Loss Expectancy. The coefficients behind both are Principle Breach's own weighting choices for relative ranking. They are not calibrated against any published incident dataset, and the absolute dollar figures should not be quoted as if they were.
Hourly revenue assumes revenue accrues evenly across all 8,760 hours in a year. Sprint risk reduction assumes a fix removes 64% of an asset's modelled risk, not all of it. What this tool is good for is the ordering of the rows; treat the totals as relative.