Risk Economics

Risk Economics helps you convert technical findings into business impact so you can prioritize work by expected loss reduction. If a term is unfamiliar (for example quota, rate limit, or workspace), open the Glossary.

Workspace: #/risk-economics

Route structure:

• Overview: workspace baseline plus latest estimate/plan/workflow posture.
• Profile: business assumptions and save flow.
• Scenario: incident inputs, estimate, plan, and auto-plan workflow start.

Quick start (10 minutes)

1. Open #/risk-economics.
2. Start on Overview and confirm the current workspace and baseline values look correct.
3. Move to Profile and save a baseline profile with realistic defaults.
4. Move to Scenario and run one estimate scenario.
5. Generate one plan recommendation.
6. Capture the output in your operating notes.

Deep dive setup flow (GUI + API parity)

Prerequisites

• Active workspace API key.
• Operator account with risk economics write permissions.
• Baseline business inputs approved by owner/finance counterpart.

Exact fields to fill

• Profile: revenue_per_hour_eur, downtime_slo_minutes, downtime_cost_multiplier, sla_tier.
• Scenario: incident_type, severity, estimated_downtime_minutes.

Step-by-step flow

1. GUI: fill profile form and click Save profile.
2. API parity: POST /api/autonomous/risk-economics/profile with same values.
3. Validate persisted profile with GET /api/autonomous/risk-economics/profile.
4. GUI: run estimate and review impact output.
5. API parity: POST /api/autonomous/risk-economics/estimate.
6. GUI/API: generate plan via POST /api/autonomous/risk-economics/plan and compare options.

Expected result

• Stored profile values are consistent across refresh/reload.
• Estimate and plan return stable, explainable outputs.
• Team can rank actions by impact and effort.

Rollback path

1. Restore previous profile values from your last approved baseline.
2. Re-run estimate/plan and confirm expected baseline behavior returns.
3. Document why rollback was required (bad assumptions or input error).

Annotated screenshot

Figure: Save profile, run estimate, and generate plan recommendation.

What you can do here

• Create/update a workspace risk profile.
• Estimate expected impact for specific scenarios.
• Compare action plans by cost vs risk reduction.
• Export or report assumptions for leadership review.

Role-based start here

• Workspace Owner: Start with Before you start, then complete Step-by-step and Known limits and rate limits.
• Workspace Admin: Focus on Step-by-step, What each button does, and API and automation.
• Security Analyst: Start at Day-2 operations and Troubleshooting, then use API error quick reference.
• Integrator/Engineer: Start at API and automation, then validate with Step-by-step and FAQ.

Before you start

Prepare these values (estimate if exact values are not available):

1. Cost per hour of major disruption.
2. Average incident response cost.
3. Typical recovery duration for high-severity incidents.
4. Your current control maturity assumptions.

Step-by-step: create your first profile

1. Open #/risk-economics.
2. Fill the profile inputs:
   • Impact cost values.
   • Likelihood assumptions.
   • Recovery/downtime assumptions.
3. Click Save profile.
4. Confirm success message and refresh once.
5. Re-open the profile and verify values persisted.

If save fails:

• Check session is active.
• Verify you are in the right workspace.
• Retry once after refresh.

Step-by-step: run an impact scenario

1. Select a scenario (or incident class) in the page.
2. Confirm baseline assumptions are correct.
3. Run the estimate.
4. Review outputs:
   • Estimated impact range.
   • Confidence/assumption notes.
   • Recommended action plan.
5. Compare at least two plans before deciding.

Interpreting outputs

• Higher estimated impact does not always mean immediate action; compare confidence and effort.
• A lower-cost control with strong risk reduction should usually be prioritized first.
• Use the notes panel to track which assumptions are uncertain and need validation.

Recommended operating cadence

• Review profile monthly.
• Re-run scenarios after major environment changes.
• Re-baseline assumptions after real incidents.

Common issues

"Unable to save profile"

Check:

1. Required fields are filled.
2. Numeric fields use valid numbers.
3. Session/token is still valid.
4. Backend route is reachable from your workspace context.

Numbers look unrealistic

Check:

1. Units are consistent (hour/day/month).
2. Currency and period assumptions match your team standard.
3. You are not mixing annual values into per-incident fields.

Who this is for

This guide is for workspace owners, workspace admins, and security operators who need clear, repeatable steps without support intervention for day-to-day execution.

Step-by-step

Follow this sequence for predictable results:

1. Open the workspace from the workspace menu.
2. Review current status/health/last update indicators before making changes.
3. Apply one change at a time and save.
4. Run the available validate/probe/refresh action.
5. Confirm the expected output appears (status change, new event, successful result).
6. If behavior is not as expected, use Troubleshooting below before repeating actions.

Day-2 operations

After initial setup, keep this surface healthy with a simple routine:

1. Daily: verify data freshness and error banners.
2. Weekly: review trends, limits, and failed actions.
3. Monthly: review permissions, keys/tokens, and stale entities.
4. After any incident: capture evidence and update your internal operating notes.

What each button does

Button labels can vary by module, but behavior is consistent:

• Refresh: reloads the latest data from backend APIs without changing configuration.
• Save: persists workspace-scoped configuration changes.
• Run/Probe/Validate: executes a non-destructive health or verification action.
• Download: fetches workspace-scoped artifact(s) (for example bundle, checksum, signature, or report).
• Verify: checks integrity/consistency and returns pass/fail details.
• Enable/Disable: toggles module behavior for your workspace; audit evidence should be recorded.

If a button appears disabled, check role permissions, required fields, and workspace license/feature entitlement first.

Self-check playbook

Use this 5-step isolation flow before escalating:

1. Configuration: confirm required inputs are present and formatted correctly.
2. Permission: confirm your role can perform the action (401/403 usually indicates authz/authn mismatch).
3. License/feature: confirm the feature is enabled for your workspace plan and module toggles.
4. Quota/rate limit: check for 429 responses and cooldown windows.
5. Service health: if you see 5xx, retry once after 30-60 seconds and capture exact error text.

If still failing, escalate with workspace ID, UTC timestamp, route, action, payload shape (no secrets), and screenshot/error response.

Troubleshooting

Use this quick triage order to reduce time-to-fix:

1. Auth/session: refresh token by signing out/in.
2. Workspace context: confirm you are in the correct workspace.
3. Inputs/config: verify required fields and formats.
4. Quota/license: confirm limits and feature entitlement.
5. Service health: retry after short delay if backend is transiently degraded.

For escalation, include workspace ID, timestamp (UTC), route name, action attempted, and full error message.

API and automation

Everything in this page should remain workspace-scoped. If your team prefers automation, use the corresponding API endpoints with the same guardrails as the UI:

• Use authenticated requests bound to your workspace context.
• Use idempotency/retry controls where available.
• Validate outcomes in the UI after automated runs.

If your endpoint mapping is not obvious, start from Help Center and follow the linked API docs.

GUI -> API quick map

GUI action	API endpoint	Expected outcome
Load saved business profile	GET /api/autonomous/risk-economics/profile	Returns workspace profile used by calculations.
Save business profile	POST /api/autonomous/risk-economics/profile	Persists profile updates for workspace planning.
Estimate incident impact	POST /api/autonomous/risk-economics/estimate	Returns impact estimate from incident+profile data.
Generate action plan	POST /api/autonomous/risk-economics/plan	Returns ranked response plan with rationale.

Copy-paste curl examples

BASE_URL="https://dralvia.tech"
API_KEY="YOUR_TENANT_API_KEY"

curl -sS "$BASE_URL/api/autonomous/risk-economics/profile" \
  -H "X-API-Key: $API_KEY"

curl -sS -X POST "$BASE_URL/api/autonomous/risk-economics/estimate" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $API_KEY" \
  -d '{"incident":{"severity":"high","surface":"identity"}}'

Postman collection notes

• Keep reusable payload templates for profile, estimate, and plan requests.
• Persist environment variables for tenant_id and api_key.
• Run profile GET after profile POST to confirm stored values.

Idempotency and retry guidance

• GET profile is safe to retry.
• POST estimate/plan are compute operations and can be retried on transient errors.
• For profile writes, fetch profile after timeout before re-submitting to avoid accidental overwrite races.

Next best actions

After finishing this page, continue with related workflows so your workspace setup stays end-to-end complete:

• EDR response and host actions
• Web Access Protection and dry-run events
• Identity risk and OAuth response
• EvidencePack verification and transparency log
• Autonomous readiness and probes

FAQ

Q: I clicked save but nothing changed. A: Refresh once, confirm permissions, and verify required fields.

Q: Why do I see missing API key/unauthorized errors? A: Confirm your workspace API key/session is valid and mapped to the correct workspace scope.

Q: Can non-admin users use this page? A: Usually read-only access is possible; write actions require workspace-admin or equivalent roles.

Next steps

After finishing this guide:

1. Validate the result in the related dashboard/workspace.
2. Export or capture evidence if this affects compliance/incident operations.
3. Share the same runbook internally so other operators follow identical steps.
4. Return to Help Center for adjacent workflows.

API error quick reference

Use this matrix when a UI action fails with an HTTP/API error.

Error	Meaning	What to do now
401 Unauthorized	Session token is missing/expired or request is not authenticated.	Sign out/in, refresh once, then retry. Confirm your session is active in the correct workspace.
403 Forbidden	You are authenticated but your role is not allowed to perform this action.	Confirm your role includes the required permission for this button/action. Ask workspace admin to grant access.
404 Not Found	The route/resource does not exist in current workspace context (or feature not enabled).	Confirm URL/route, workspace context, and feature availability. Refresh and retry; if persistent, capture timestamp and route and contact support.
429 Too Many Requests	Rate limit/quota window was exceeded.	Wait for cooldown/reset window, retry once, then reduce burst traffic/backoff if automated.
500 Internal Server Error	Backend failed unexpectedly while processing the request.	Retry after 30-60 seconds. If still failing, escalate with workspace ID, UTC time, route, action, and full error text.

Known limits and rate limits

These limits can vary by plan and feature, but behavior is consistent:

• Burst traffic can trigger 429 Too Many Requests.
• Workspace quotas apply per feature/module and reset on configured windows.
• Repeated retries without backoff can extend recovery time during saturation.

Recommended operator behavior:

1. Retry once after cooldown for 429 responses.
2. Use exponential backoff in automation.
3. Monitor usage/quota dashboards for sustained high utilization.
4. Request quota review when normal workload regularly approaches limits.