Why You Should Model Your Cyber Risk

Businesses can better understand their cyber risk and build more effective cyber insurance and risk management programs through modeling, according to speakers on Marsh’s The New Reality of Risk® webcast.

Cyber risk was among the most critical risks identified by businesses in Marsh’s Excellence in Risk Management survey. Businesses continue to be challenged by longstanding cyber risks such as data breaches, cyber theft, and reputational risk. And more organizations are grappling with emerging risks such as cyber extortion, ransomware, and business interruption as a result of technology outages.

As cyber events are virtually inevitable for any business, it’s critical to model and map specific cyber risks in order to effectively mitigate them. “Even with an unlimited security budget, no chief information security officer can guarantee his or her board that the company will not suffer from a cyber event like a breach or business interruption,” said Phil Rosace, solutions manager at Cyence. “Since we can’t eliminate the risk, the first step to managing it is a deeper understanding.”

The process for modeling cyber risk can take many forms, but often includes scenario planning. By creating a scenario of a likely event, a business can see how it would play out and affect the organization. In turn, these models can yield valuable information, including the potential cost of a cyber event, which can inform cyber risk management strategies.

Modeling can also provide insights that can help businesses make better insurance purchasing decisions, including taking a more holistic approach to cyber risks across their entire insurance program. Although property and casualty insurers are willing to provide coverage for some cyber exposures, it’s critical to look at all three forms of coverage in concert, said Bob Parisi, Marsh’s cyber product leader. “The cyber insurance market is helping to broaden and enhance risk transfer options that are available to businesses, including some related to directly loss and liability,” Parisi said.

Listen to the webcast replay.