Cyber Monitoring Center
An independent UK body launched in 2025 that ranks major cyberattacks on a one-to-five scale by financial impact, like hurricane categories, to give the market a common benchmark.
For natural catastrophes, the market has shared measures: a hurricane's category, an earthquake's magnitude, loss estimates published by reference bodies. For cyber, each major incident produced disparate figures, often from the companies themselves or the press. The Cyber Monitoring Center, an independent non-profit launched in the United Kingdom in early 2025, with the support of insurance players and chaired by a former head of the UK National Cyber Security Centre, seeks to fill this gap. When a cyber event affects several UK organizations, a technical committee analyzes it and ranks it on a one-to-five scale, based on an estimate of the financial impact on the country's economy. The attacks on two major retailers in spring 2025 were ranked category 2; the attack on a major carmaker in late summer 2025 category 3, with an estimate of about two billion pounds. The initiative's reach goes beyond statistics. Common categories make it possible to define triggers for parametric cyber products, to calibrate accumulation models on observed events, and to discuss systemic cyber risk in a vocabulary investors already know.
On June 20, 2025, the center ranked the April attacks on Marks & Spencer and Co-op as a category 2 event and put the loss to the UK economy at between 270 and 440 million pounds. The range is published together with its method: that is what a parametric trigger can cite.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.