Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. Classical actuarial technique assumes the mechanism producing losses stays stable. Why will cyber not meet that condition, even with more data?
Because the adversary adapts, technology changes faster than the observation window, and losses are correlated: this stems from the nature of the risk more than from missing data
The distinction between a data shortfall and a property of the risk decides what to expect of the future: the first is fixed by waiting, the second never. The three other answers name genuine difficulties, and all are data shortfalls. Under-reporting improves with notification duties. Short series lengthen mechanically. Heterogeneous definitions are handled by restating, which the module indeed requires. None touches the point: when a measure becomes common, attackers change route, so last year's frequency describes a threat picture that no longer exists.
Glossary entry →2. The module offers a bundle in place of a prediction. What is exposure measured on, and why not annual revenue?
On what produces the cost: number of personal data records held, daily revenue interrupted, dependency on a single system
The cost of a cyber loss forms per day of stoppage and per record held, not per year of revenue, and measuring exposure on the quantity that produces it is what separates a calculation from an approximation. The replacement value of the system describes what is almost always the smallest item, servers not being what costs. Headcount measures an entry surface and not an exit cost. Sector-adjusted annual revenue is convenient and that is exactly its weakness: two companies with the same annual figure can lose very different amounts per day of stoppage depending on seasonality and their ability to catch up.
Glossary entry →3. What is a scenario model asked, and how does that question differ from the one you would like to ask?
It is not asked the probability of a loss, a question nobody can answer, but what happens if a given provider is unavailable for forty-eight hours: it produces a loss distribution conditional on a scenario
Conditioning is the whole device: probability is given up and one works on amounts, which is less satisfying intellectually but available. The answer asking for a corrected frequency reintroduces exactly the quantity just declared inaccessible. The one ranking insureds by probability does the same at the individual level, where it is harder still. The one speaking of probable maximum loss names a real tool of the trade and has it replace the limit, when a limit is a capacity decision and a model does not take it.
Glossary entry →4. An insured has reported no loss in four years and asks for a reduction. What does that absence actually tell you?
The size of its sample, which is one, and not its future risk: if its sector's frequency has tripled, last year's premium no longer describes this year's risk
It is the exact opposite of what an operator expects from an insurance relationship, and saying so plainly beats dressing the increase up as a commercial argument. The answer treating it as validation of the controls turns a non-observation into proof, which it never is on a sample of one. The one assuming under-reporting is often factually true and does not answer the question, since it bears on what the insured concealed rather than on what the absence tells you. The one dismissing individual experience altogether hardens the point until it is false: a loss that occurred is information, it is its ABSENCE that is not.
Glossary entry →5. A five year series shows sharply rising average loss. What restatement does the module require before reading a trend into it?
That of changes in cover scope: when policies began covering business interruption without material damage, the average loss jumped with no change in the number of attacks. An unrestated series measures the evolution of contracts as much as that of attacks
Observed loss experience depends on the cover sold, and it is the restatement nobody performs because it requires knowing the history of wordings rather than of attacks. An actuary who omits it sees a trend where there is a reform. The three other restatements are normal, correct professional steps. Inflation is corrected for and weighs less. Portfolio growth affects total burden and not the AVERAGE, which is what the question concerns. Exceptional losses are handled by capping, a useful precaution that leaves the scope distortion untouched.
Glossary entry →