Cyber risk quantification (CRQ)

June 27, 2017: NotPetya spreads through an update of the Ukrainian accounting software M.E.Doc and within a day cripples companies on several continents. One vector, thousands of victims: that is the kind of correlation cyber risk quantification has to put a number on. CRQ seeks the probable cost, in euros or dollars, of a cyber event for a given organization. It draws on formal probabilistic models, of which the FAIR framework (Factor Analysis of Information Risk) is the most widespread, and on stochastic simulation models that generate loss distributions from threat scenarios. The hard part is data. Cyber is a recent, non-stationary risk whose loss experience tracks attackers' offensive capabilities, and the homogeneous history available for fire or life does not exist. Actuaries therefore combine internal data, external threat intelligence, vulnerability scan results and sector benchmarks. The outputs set attachment points and limits for reinsurance layers, feed an internal Solvency II cyber SCR model, and recalibrate occurrence probabilities against red teaming results. When the same vector hits thousands of policyholders at once, the independence assumption behind classical actuarial models breaks down.