Top-Down vs Bottom-Up Cyber Risk Quantification
Run both approaches against one company and the figures differ, which is expected. The useful part is that they differ in a predictable direction, which makes the distance between them informative rather than embarrassing. Bottom-up tends to come in lower and top-down higher, for reasons that follow from how each is built. Knowing which way each one leans is more useful than choosing between them.