Top Stories
The Insurance Industry’s Saving Grace: Automated Cyber Risk Quantification
Published by maria gbaf
Posted on August 24, 2021
5 min readLast updated: January 21, 2026
Global Banking & Finance Review®
Company
Published by maria gbaf
Posted on August 24, 2021
5 min readLast updated: January 21, 2026
By Miles Tappin, VP of EMEA at ThreatConnect
The emergence of sophisticated attacks, particularly ransomware, has placed a cloud over the cyber insurance market. As a result, in recent years, more firms have sought insurance protection to limit potential threats and ultimately safeguard themselves and their customers. However, neither carriers nor those seeking insurance have the capacity to automate risk. The financial models required to quantify security enhancements and minimise overall response times and exposure were also required.
The sophistication of cyberattacks and their frequency has resulted in a rise in demand for policies and rising prices. Several carriers have increased rates by 30% to 50%, as well as enacting more stringent policy terms and coverage restrictions. According to some insurance brokers, carriers have reduced the amount of coverage given by millions, and at least one major insurer, European insurance giant AXA, has withdrawn entire ransomware coverage.
Ultimately, the cyber insurance industry is confronted with three major problems. When it comes to obtaining data and analysing a company’s cyber risk exposure, insurance underwriters use a very manual, point-in-time method. However, these underwriters are unable to link loss data to vulnerabilities, insufficient controls, misconfigured hardware or software, or an attacker’s ability to successfully infiltrate a vital application or system. Security evaluations are performed only once before binding coverage and are not repeated until the policy is due to be renewed. Security evaluations performed on behalf of an underwriter are frequently never disclosed with the firm seeking insurance. As a result, the industry presents a significant vulnerability.
Urgent need to automate the quantitative process
It’s hard to believe, but just one year ago, most cybersecurity insurance questionnaires consisted of less than ten questions, and underwriters would give companies 60 to 90 days to get the required controls in place. Today, most applications involve dozens of questions, are still highly manual, and companies only get 30 days to get their security controls in order.
Today’s manual application process means underwriters are writing policies based on guesswork that is only valid on the day it was produced. Thus, the requirement to automate the quantitative process could not be more urgent.
Automated cyber risk quantification is now a reality. Businesses should move quickly to understand their business more accurately and prioritise efforts so that critical business processes, applications, and data are protected. Security Orchestration, Automation, and Response (SOAR) can provide three specific benefits. It enables companies to proactively model and predict risk, mitigate and monitor for changes and see ‘what-if’ recommendations that drive smart actions, mitigations, and response.
Cybersecurity insurance is different from other forms of insurance primarily because cyberattacks involve two things insurance can’t measure — the attacker and the defences they try to beat.
The struggle to understand loss exposure in cybersecurity isn’t the lack of loss data – it’s the lack of being able to correlate it to a vulnerability, a deficient control, a misconfigured software or hardware, or the ability of an attacker to reach a critical system or application.
Risk quantification automatically enters data into a risk model and automation engine. Those inputs include data from your organisation as well as industry, attack, and vulnerability data aggregated through various sources. That information is then applied to the risk model and automation engine to determine the financial impact of cyber risks and the probability of success of specific attacks.
These calculations drive a variety of other activities within risk quantification that lead to the operationalisation of information across the rest of your organisation, including:
Given the advanced capabilities of cyber adversaries and their tactics, techniques, and procedures, the current cyber insurance model almost guarantees that insurance carriers will be forced to pay claims. As a result, point-in-time assessments that are manual guesswork are inadequate for protecting enterprises from the onslaught of cyberattacks.
Being able to track cyber financial risk over time, understand the impact of budget decisions, and ultimately justify spending is now driving business decisions on which risks to tolerate, treat or transfer.
While the first step is to understand your organisation’s exposure in financial terms, the next is to decide how to mitigate risk. Risk quantification models many different types of attackers and attacks that may infiltrate an organisation, its controls, vulnerability data and critical applications.
Most risk quantification customers have their controls actively updated in the tool to assess which applications are most vulnerable. Still, they also provide vulnerability data that allows risk quantification to provide short-term recommendations on Common Vulnerabilities and Exposures (CVEs).
The capabilities of risk quantification can give insurance underwriters and their clients a clear picture of inherent and residual risk in a dynamic fashion. Not only is the threat landscape and the parts of it that are relevant to your business changing, but the controls, applications, endpoints, and type of data present in your environment are changing as well. Risk quantification enables you to apply these changes instantaneously to your models, allowing cyber risk measurement to move beyond point-in-time assessments and become programmatic.
After the analysis is completed, it is written up in a report that corporate executives, board members, and insurance underwriters can comprehend.
Explore more articles in the Top Stories category
