Interviewer view · keep this screen to yourself
Is a security upgrade worth it for a logistics company in Dubai?
You run the case. Read the prompt, answer questions from the notes below, and share data only when the candidate asks for it or gets stuck. Score at the end.
Case timer
00:00
1. Read the prompt aloud
Read it slowly, then pause. Let the candidate ask questions before they structure.
A logistics company in Dubai reports in USD. Its security team estimates an 8 percent chance each year of a major ransomware attack that would stop operations, costing about USD 6 million. A package of controls (endpoint detection, multi-factor login for all staff, and offline backups) costs USD 200,000 a year. The team estimates it cuts the chance to 3 percent a year and, because recovery is faster, cuts the cost of an attack to USD 4 million. Is the package worth it on expected loss? (Figures are illustrative.)
2. Answers to clarifying questions
This case has no scripted clarifying answers. Answer from the prompt, and say "assume what you think is reasonable" if the prompt does not cover it.
3. A model structure
Compare the candidate's structure with this one. A different split can be just as good if it is clean and fits the problem.
- Net benefit = drop in expected loss minus the cost of the controls
- Expected loss = probability a year x cost of an attack
- Compare before and after the controls
- Subtract the yearly cost of the controls
4. The working, step by step
Each step shows how a strong candidate works it out. Share a new fact from it only when the candidate asks or is stuck, and let them do the math: the result in the dark box is what they should reach.
Step 1: Expected loss today
What a strong candidate does: 8 percent of USD 6 million, in USD millions.
Expected loss today (USD millions a year): 0.08 × 6 = 0.48
Step 2: Expected loss with the controls
What a strong candidate does: 3 percent of USD 4 million.
Expected loss with controls (USD millions a year): 0.03 × 4 = 0.12
Step 3: Drop in expected loss
What a strong candidate does: 0.48 minus 0.12.
Drop in expected loss (USD millions a year): 0.08 × 6 - 0.03 × 4 = 0.36
Step 4: Net benefit
What a strong candidate does: The drop minus USD 0.2 million of yearly cost.
Net benefit a year (USD millions): 0.08 × 6 - 0.03 × 4 - 0.2 = 0.16
The recommendation to listen for
At the end, say: "The CEO walks in. What is your recommendation?"
The company should buy the package, because it lowers expected losses by about USD 360,000 a year for USD 200,000, a net benefit of about USD 160,000 a year. First, most of the gain comes from making an attack less likely, from 8 to 3 percent. Second, faster recovery also matters: cutting the cost of an attack from USD 6 million to USD 4 million protects the business if an attack gets through anyway. The risk is that the probabilities are rough estimates; the case still holds if the true chance today is 6 percent rather than 8, but not much lower, because below about 5.3 percent the drop in expected loss no longer covers the cost. As a next step, check what the company's cyber insurer requires, since these controls may also lower the premium.
Risks a strong answer names: Probabilities are estimates and could be far off; Controls only work if staff use them and backups are tested; A single attack can cost much more than the average.
Score the candidate
Score each criterion from 1 to 5. A 2 or a 4 sits between the descriptions.
This case has no exhibit. Score Exhibit reading on how the candidate used the data you gave them: did they pick out the number that matters and say what it means?
Total
0 out of 25
Score all five criteria to see the band and the feedback template.