Where previously estimations and anecdotes sufficed, a new mathematical model will place precise dollar amounts on the IT security risks the state faces.