Structured Analytic Tradecraft · Quanta Analytica Process™

CARVER
Structured
Risk
Prioritization

Criticality · Accessibility · Recuperability · Vulnerability · Effect · Recognizability

At Quanta Analytica, CARVER is used to structure, justify, and prioritize risk. We use it to convert diffuse threat environments into transparent, defensible, decision-ready priorities inside the Quanta Analytica Process™.

Structured Analytic Tradecraft Risk Prioritization Engine Likelihood + Impact Mapping ISO Matrix Support Decision-Ready Intelligence
Why We Use It How We Apply It ISO Mapping
00
Overview

Why CARVER matters
inside Quanta Analytica

CARVER is one of the structured analytic tools we use to move from vague concern to disciplined risk prioritization. It helps us break down complex threats, assets, vulnerabilities, and exposure points into an analytic model that leadership can actually use.

Within the Quanta Analytica Process™, CARVER sits inside the Structured Analytic Tradecraft Layer alongside ACH, Key Assumptions Checks, scenario modeling, and risk matrix scoring. We do not use CARVER to produce abstract numbers. We use it to support clearer judgment, stronger prioritization, and more defensible decisions.

In practice, CARVER helps answer five core questions: what matters most, what is easiest to exploit, what would be hardest to recover, where mitigation should be focused first, and which vulnerabilities are operationally significant rather than merely visible.

Why We Use It

  • To turn diffuse threats into ranked priorities
  • To make scoring logic transparent rather than impressionistic
  • To connect narrative intelligence to measurable prioritization
  • To distinguish visible risks from consequential risks

Where It Sits

  • Problem framing first
  • Evidence harmonization second
  • CARVER inside structured analytic tradecraft
  • Then decision thresholds, scenarios, and recommendations

What It Supports

  • Security risk assessments
  • Conflict and infrastructure analysis
  • Enterprise risk reviews
  • Insider threat and vulnerability mapping
01
Dimensions

The Six CARVER Dimensions

How we decompose priority and exposure

Criticality

How important the asset, function, node, or risk is to the wider system. High criticality means disruption would matter materially.

Accessibility

How easy the target is to reach, access, or engage. High accessibility usually raises the probability of exploitation.

Recuperability

How quickly and effectively the system can recover after disruption. Low recuperability increases downstream consequence.

Vulnerability

How exposed the system is to attack, pressure, compromise, or failure. High vulnerability means less resistance to disruption.

Effect

The severity of consequences if the event occurs. This captures disruption scale, operational loss, and broader systemic impact.

Recognizability

How easily an actor can identify the target, weakness, or opportunity. Highly recognizable targets are easier to exploit.

02
Logic Flow

The CARVER Decision Flow

Decompose → score → translate → decide
1 · DECOMPOSE THE RISK Asset · threat · weakness · consequence 2 · SCORE CARVER C · A · R · V · E · Rz on a 1–5 scale 3 · TRANSLATE TO ISO LOGIC Likelihood and Impact from dimension groups 4 · DECISION PRIORITIZATION Rank · compare · threshold · mitigate CARVER is the analytic substrate. The ISO matrix is the decision display. We use CARVER to structure and justify Likelihood and Impact, then use the matrix to communicate priority, thresholds, and mitigation focus in executive decision form.
03
Workflow

How We Apply CARVER

Structured judgment inside a governed process
1Step I
Problem Framing
Define the target system, exposure points, and operational question
We begin by defining what is actually being assessed: an asset, a corridor, an organization, a platform, a site, a leadership node, or an operating environment. This matters because CARVER is only as strong as the object of analysis and the decision question attached to it.
Output: analytic object and decision question
2Step II
Dimension Scoring
Assess Criticality, Accessibility, Recuperability, Vulnerability, Effect, Recognizability
Each dimension is scored on a defined scale, usually 1 to 5. The goal is not pseudo-precision. The goal is disciplined decomposition: forcing the analyst to explain what exactly makes the risk important, exploitable, harmful, or difficult to recover from.
Output: transparent CARVER profile
3Step III
Comparative Prioritization
Rank assets, threats, or vulnerabilities against each other
Once scored, CARVER helps identify where the greatest exposure or consequence actually sits. This is where the method becomes operationally useful: not in describing a single risk, but in showing why one problem deserves more attention, resources, or monitoring than another.
Output: ranked risk priorities
4Step IV
Risk Matrix Translation
Map CARVER into Likelihood and Impact for executive display
Rather than assign Likelihood and Impact impressionistically, we derive them from the CARVER dimensions. This creates a more defensible ISO-style matrix and makes the rationale visible instead of implicit.
Output: matrix-ready risk score
5Step V
Decision Support
Use the ranked output to inform thresholds, mitigation, and resource focus
The endpoint is not a table. The endpoint is action. CARVER helps determine where mitigation should start, what must be protected first, and which risks demand executive attention because recovery cost, consequence, or exploitability is materially higher.
Output: defensible prioritization for action
04
ISO Mapping

CARVER and the ISO Risk Matrix

Pre-matrix scoring engine
Likelihood
Accessibility + Vulnerability + Recognizability

These dimensions tell us how easy the target is to reach, identify, and exploit. High scores increase the probability of occurrence or compromise.

Impact
Criticality + Effect + Recuperability

These dimensions tell us how damaging the event will be if realized, including operational importance, disruption severity, and recovery burden.

Practical Interpretation

  • Likelihood answers: can it happen and how easily?
  • Impact answers: how bad is it if it does?
  • Both are normalized to a standard 1–5 matrix scale
  • The matrix then becomes the executive display layer

Why Recuperability Matters

  • It expands impact beyond immediate damage
  • It captures recovery time, resilience drag, and restoration burden
  • Two equal shocks may have very different impact if one takes months to recover
  • This is where CARVER strengthens conventional matrix logic
CARVER DimensionPrimary ISO RoleWhat It Adds
CriticalityImpactHow essential the asset, system, or node is to the wider mission or operating environment
AccessibilityLikelihoodHow easy it is for the threat or stressor to reach the target
RecuperabilityImpactHow difficult, slow, or expensive recovery will be after disruption
VulnerabilityLikelihoodHow exposed the target is to exploitation or failure
EffectImpactThe severity and operational consequence of compromise or disruption
RecognizabilityLikelihoodHow visible or discoverable the target or weakness is to an adversary or hazard pathway
05
Use Cases

Where CARVER is Most Useful

Anywhere priorities must be explicit

Security Risk

Facilities, routes, personnel exposure, and protective resource prioritization.

Conflict Environments

Corridors, infrastructure, escalation nodes, and critical operating vulnerabilities.

Corporate Risk

Supply chain chokepoints, geopolitical exposure, and business continuity planning.

Insider Threat

Processes, access pathways, sensitive nodes, and recovery burden after compromise.

CARVER is not used to replace judgment. It is used to structure and justify it.
Quanta Analytica · MNS Consulting

Use CARVER in a Quanta Analytica Assessment

Structured intelligence · transparent prioritization

We apply CARVER when clients need a defensible way to rank risks, justify mitigations, and move from narrative description to operational prioritization. It is especially useful when leadership needs to know not just what is risky, but what matters most right now.

Back to Top See ISO Mapping Review Workflow

CARVER is one of the structured analytic tools used inside the Quanta Analytica Process™ to produce decision-ready risk intelligence.