scenario-modeler - SKILL.md Agent Skill

name: scenario-modeler description: > Interactive risk scenario modeling engine for CyberRadar. Builds what-if analysis capabilities: "if we implement control X, how does Cyber Score change?", "if threat Y materializes, what's the financial impact?", "if vendor Z is breached, what's our exposure?" Combines CRQ engine, Cyber Score simulator, control effectiveness projections, and treatment comparison. Supports scenario saving, comparison, and board presentation. Triggers on: what-if, scenario, simulation, risk modeling, treatment comparison, impact analysis, risk scenario, threat modeling, control simulation.

Act as Scenario Modeling Lead for CyberRadar.

Mission

Build an interactive scenario modeling engine that lets risk managers and CISOs simulate changes to their risk posture before committing resources — answering "what if?" questions with data-backed projections.

Scenario Types

Type 1: Control Implementation

"What if we implement MFA across all cloud accounts?"

Input: control to implement, coverage scope, implementation timeline
Output: projected Cyber Score delta, compliance score improvement, CRQ loss reduction, affected risks, estimated cost vs benefit

Type 2: Threat Materialization

"What if a ransomware attack hits our production environment?"

Input: threat type, affected asset scope, attack vector
Output: financial impact (CRQ), affected controls, evidence gaps exposed, recovery timeline, insurance coverage applicability

Type 3: Vendor Breach

"What if our payment processor is breached?"

Input: vendor, breach type, data involved
Output: downstream impact on tenant's risk posture, affected controls, regulatory notification requirements, financial exposure, SLA implications

Type 4: Regulatory Change

"What if SAMA introduces new cloud security requirements?"

Input: new requirements (manual or from regulatory tracker), framework mapping
Output: gap analysis, controls needing implementation, compliance score impact, resource estimate, timeline to compliance

Type 5: Treatment Comparison

"Compare: option A (implement WAF) vs option B (buy cyber insurance)"

Input: two or more treatment options with costs and projected effectiveness
Output: side-by-side CRQ comparison, Cyber Score projection, ROI analysis, break-even timeline, residual risk comparison

Data Model

scenarios — saved scenarios (RLS)
  id uuid PK, tenant_id uuid,
  name text NOT NULL, description text,
  scenario_type text NOT NULL,
  inputs jsonb NOT NULL, assumptions jsonb,
  status ('draft','computed','presented','archived'),
  created_by uuid FK→users, created_at timestamptz, updated_at timestamptz

scenario_results — computed outcomes (RLS)
  id uuid PK, tenant_id uuid, scenario_id FK→scenarios,
  current_state jsonb NOT NULL,
  projected_state jsonb NOT NULL,
  delta jsonb NOT NULL,
  cyber_score_current numeric, cyber_score_projected numeric,
  crq_ale_current numeric, crq_ale_projected numeric,
  compliance_impact jsonb, risk_impact jsonb,
  confidence_level numeric,
  computed_at timestamptz

scenario_comparisons — side-by-side (RLS)
  id uuid PK, tenant_id uuid,
  name text, scenario_ids uuid[] NOT NULL,
  comparison_results jsonb,
  recommended_scenario_id uuid,
  recommendation_rationale text,
  created_at timestamptz

Simulation Engine

Snapshot current state (Cyber Score, CRQ, compliance scores, risk register)
Apply scenario inputs as deltas to current state
Recompute affected dimensions using same formulas as live computation
Calculate projected state
Compute delta and confidence interval
Store results for comparison and presentation

Confidence Scoring

High (80-100%): scenario inputs map directly to existing data (e.g., implementing a control we already have data for)
Medium (50-79%): some inputs are estimates (e.g., threat probability based on industry data)
Low (20-49%): significant assumptions required (e.g., novel threat without historical precedent)
Show confidence alongside all projections

Board Presentation Mode

Export scenario comparison as slide-ready format
Include: current state → projected state visual
Financial impact in tenant currency
ROI chart for treatment options
Risk appetite line overlay
Recommendation with rationale

Downstream Wiring

Scenario results feed into AI recommendations engine
Approved scenarios → can trigger actual implementation tasks
Scenario history feeds into trend analysis
Board report can include "recommended scenarios" section

Anti-Patterns

NEVER present projections without confidence intervals
NEVER auto-implement scenarios — they require explicit approval
NEVER simulate without current-state snapshot (stale baselines mislead)
NEVER allow scenarios to modify live data
NEVER hide assumptions — they must be explicit and reviewable