Planning Risk Mitigation Investments has not been easy. However, if you have a good risk quantification approach, then it can become surprisingly intuitive and effective. This is a walkthrough of the investment design process at the ManageXValue platform. It is easy to differentiate between Proactive and Reactive improvement actions. It is even easier to identify what Attack Surfaces and what Proactive Capabilities to focus on to mitigate specific Threat Actions. Same for Organization Units, Reactive Capabilities and Risk Events. Designing a Risk Mitigation Investment is now supported by quantified risk analytics.