Risk quantification assigns a value to the potential impact of a cyber threat. This article explains the method, the data it needs and how the result supports decisions.