Axio and Excel – Elevating Risk Management with CRQ

Turning Risk into Strategic Action: How Xcel Energy Uses Quantification to Drive Decisions 

In today’s rapidly evolving threat landscape, CISOs and risk leaders face a common challenge: translating cybersecurity and operational risks into terms that business leaders truly understand and act on. 

During a recent Axio webinar, David White (President & Co-founder of Axio) sat down with Luke Cunningham, Principal Security Analyst at Xcel Energy, to discuss how his team has embedded risk quantification into strategic decision-making across the enterprise. 

From Qualitative to Quantitative Risk 

Like many organizations, Xcel Energy initially assessed risk in qualitative terms: high, medium, low. While useful, those labels often fell short when engaging executives. As Cunningham noted, “If you tell an operations leader something is a medium risk, it can get lost in translation. But if you say that same risk could cost millions in lost revenue and customer impact, you have their attention.” 

Using Axio’s scenario-based methodology, Xcel shifted to dollar-value impact modeling supported by Monte Carlo simulations and real-world probability data from Cyentia. This allowed them to: 

• Quantify cyber, physical, and operational risks 
• Show financial impact in clear, comparable terms 
• Build compelling business cases for control investments 

Beyond Cyber: A True Enterprise Risk View 

While Axio is known for cyber risk quantification, Xcel uses it for a wide range of operational scenarios, from supply chain disruptions to extreme weather events to federal directives. By modeling both probability and impact, they can make data-driven decisions on investments such as redundant facilities, resilience improvements, and vendor risk mitigation. 

Embedding Risk Quantification Across the Organization 

The program’s success has grown through grassroots adoption. Engineers and operations teams now create and maintain their own scenarios, feeding into a centralized library of over 130 modeled risks. This distributed approach: 

• Builds “risk champions” within business units 
• Expands coverage without overloading the central risk team 
• Creates a culture of risk-informed decision-making 

Reporting That Drives Conversations 

Xcel tailors Axio’s reporting for both the board and operational leaders. Quarterly snapshots highlight top quantified risks per business unit, overlaid with Monte Carlo curves for easy comparison. This targeted reporting keeps risk on the agenda without overwhelming stakeholders with unnecessary detail. 

Luke Cunningham’s Top Tips for Getting Started 

1. Tell the story, not just the number. Use quantification to explain how a risk unfolds, its operational impact, and the effect of mitigation. 
2. Engage the business early. Make them part of scenario creation to ensure buy-in. 
3. Start with high-impact, relatable scenarios. Build momentum by focusing on risks leadership already cares about. 

Your Next Step: See It in Action 

Whether you’re looking to justify security investments, align with the board, or integrate cyber into enterprise risk, Axio’s Proof of Value process can show the impact in your own environment. 

Walk through your top scenarios, quantify the financial exposure, and uncover the ROI of your mitigation strategies in days, not months. 

👉 Schedule your Axio Proof of Value and turn your risk data into decisions.