Frequency-severity model (Poisson x lognormal) simulated over 20,000 years: annual loss distribution and loss / return-period curve (99.5% VaR). An order of magnitude of loss, with no premium and no cover. 100% in the browser, parameters and sources shown.
1.21%
Annual cyber claim frequency for insureds under $25M in revenue, in 2025.
Coalition, Cyber Claims Report 2026
€21K
Average cost of an SME cyber claim paid in France in 2024 (€48K in 2023).
AMRAE, LUCY 2025
$246K
Average incident cost under $2B in revenue, claims from 2020 to 2024.
NetDiligence, Cyber Claims Study 2025
4%
GDPR fine ceiling, as a share of worldwide annual revenue.
GDPR, Article 83
Organization profileImplied revenue €90M
Sector
Size
Cyber-security maturity
Partial MFA, regular backups, EDR on key endpoints.
Sensitive personal data (health, banking, biometric)
Average annual loss
€28K
Expected cyber loss over one year, across all scenarios.
Probability of at least one claim this year: 5.5%
Most years pass with no claim: the loss is carried by rare but severe scenarios. The tail is what matters.
Loss / return-period curve
The horizontal axis is the return period: the 1/100 point is the annual loss exceeded on average one year in a hundred, a 1% chance in any given year.
Return periodVaR
1 / 10€0
1 / 20€31K
1 / 50€356K
1 / 100€765K
1 / 200 · VaR 99.5%€1.3M
1 / 100 reads one year in a hundred: the annual loss shown has a 1% chance of being exceeded this year. At 1 / 200, one year in two hundred, or 0.5%, the VaR 99.5% threshold.
Under 15% of revenue
Weight of the 1-in-200 loss
1.4% of revenue
The 1-in-200 scenario stays under 15% of implied revenue.
What the simulation shows
The model's first lever is frequency: with a mature posture, the average annual loss would fall by about 45%.
Cyber-maturity lever
HighLow
A mature posture would bring the average annual loss to €16K (about -45%). Maturity drives frequency, the primary engine of the risk.
Average annual loss
€28K
High
€16K
1-in-200 loss
€1.3M
The link reopens this exact scenario: profile and assumptions.
How it is calculated▾
Model parameters
Annual frequency (lambda)0.056
Median severity per event€216K
Lognormal dispersion (sigma)1.35
Severity cap (single event)€90M
Simulated years20,000
Sources & calibration
Frequency and severity recalibrated on 26 September 2026 against insured claims published in 2025 and 2026:
·Frequency of claims, not of incidents reported in surveys: Poisson with parameter lambda (sector x size x maturity), 1.5% a year for a small firm at medium maturity.
·Severity per event: lognormal (median and dispersion by sector, size and data sensitivity).
·Aggregate losses via a seeded, therefore reproducible, simulation over 20,000 years.
·Single-event severity capped at annual revenue (an implicit bound covering the 4% GDPR maximum).
·Maturity acts on frequency, not on severity once an incident occurs.
·Calibrated on European and US insured claims: the order of magnitude is that of observed losses, not the loss of a given company.
Order-of-magnitude model, for educational and framing purposes. Coefficients are calibrated on dated public sources (AMRAE LUCY 2025 and 2026, Coalition 2025 and 2026, NetDiligence 2025, NAIC as read by Fitch) and do not replace a model specific to your exposure, contracts and cover. No premium, deductible or cover limit is computed here, and nothing says whether a risk is insurable or should be covered: no pricing, no recommendation, no advice.
AlgoPolis