Cyber risk is calculated by considering the identified security threat, its degree of vulnerability, and the likelihood of exploitation. At a high level, this can be quantified as follows: Cyber risk = Threat x Vulnerability x Information Value.