The invention is a method of measuring and representing security risk. The method comprises selecting at least one object within an environment and quantifying the strength of controls of at least one object within that environment. This is done by quantifying
authentication controls, quantifying
authorization controls, and then quantifying
structural integrity. In the preferred method, the next step is setting global variables for the environment, for example, whether the environment is subject to regulatory laws, and then selecting at least one
threat community, for example, professional hackers, and then calculating information risk. This calculation is accomplished by performing a
statistical analysis using the strengths of controls of said at least one object, the characteristics of at least one
threat community, and the global variables of the environment, to compute a value representing information risk. The method identifies the
salient objects within a risk environment, defines their characteristics and how they interact with one another, utilizing a means of measuring the characteristics, and a statistically sound mathematical calculation to emulate these interactions and then derives probabilities. The method then represents the security risk, such as the risk to
information security, such as by an integer, a distribution or some other means.