A Quantitative Example
One can certainly debate the extent to which it makes sense to represent value and probability quantitatively, but there are cases in which it is appropriate. These are cases in which the losses are entirely or primarily economic losses readily measurable in dollars, and in which it is relatively easy to make accurate quantitative assessments of probability. The conditions are often fulfilled in the case of identity theft resulting from unauthorized access to online information. Consider the following example.
Suppose you are the Chief Security Officer of ChoicePoint, one of the largest data aggregators. Unauthorized access to the information leads to identity theft and other crimes. The resulting aggregate yearly loss from these crimes is $10,000,000. There are improvements to ChoicePoint’s security which would make unauthorized access much more difficult and would, with a probability of 0.6, reduce this loss to $5,000,000 for one year. After one year, the criminals will figure out how to bypass the system, and it will be ineffective.
The expected benefit of implementing the improvements is