# Automated Cyber Risk Quantification: Saving the Insurance Industry Author: Pal Sinha, Barnali Author URL: https://financedigest.com/author/pal-sinha-barnali Published: 2021-07-07 Category: TECHNOLOGY Category URL: https://financedigest.com/category/technology Meta Title: Automated Cyber Risk Quantification: A Solution for the Meta Description: Learn about the impact of ransomware and automation challenges in the cyber insurance market. Stay protected with automated risk quantification. URL: https://financedigest.com/automated-cyber-risk-quantification-saving-the-insurance-industryhtml ![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/graphicstock-man-using-digital-device-make-payments-online-shopping-and-icon-customer-network-connection-on-screensdfgeu2vlol-1736838213101-compressed.jpg) _By **Miles Tappin,** VP of EMEA at ThreatConnect_ The rise of advanced threats, particularly ransomware, has cast a shadow over the cyber insurance industry. As a result, more businesses have been looking for [insurance protection in recent years to ensure they can mitigate future](https://www.financedigest.com/insuring-themselves-for-the-future.html "Insuring themselves for the future") threats and protect themselves and their customers. However, both carriers and those seeking [insurance lack the inherent ability to automate risk](https://www.financedigest.com/improving-risk-management-in-the-insurance-industry.html "Improving risk management in the insurance industry"). Likewise, the financial models [needed to calculate security](https://www.financedigest.com/why-preparation-for-new-swift-cyber-security-standards-needs-to-start-now.html "‘Why preparation for new SWIFT cyber security standards needs to start now’") improvements and reduce overall response times and exposure. The escalation in the sophistication of cyber-attacks has led to a climb in [demand for policies](https://www.financedigest.com/opec-seen-sticking-to-policy-despite-higher-oil-demand.html "OPEC+ seen sticking to policy despite higher oil demand") and increasing costs. Several carriers have raised premiums between 30% and 50% and introduced further restrictive policy terms and coverage limits. Some [insurance brokers have reported carriers reducing the amount of coverage](https://www.financedigest.com/5-tips-for-selecting-the-best-car-insurance-coverage.html "5 Tips for Selecting the Best Car Insurance Coverage") offered by millions, and at least one primary carrier, European insurance giant AXA, has dropped ransomware coverage altogether. Ultimately, the [cyber insurance](https://www.financedigest.com/are-you-getting-what-you-are-paying-for-when-it-comes-to-cyber-liability-insurance.html "ARE YOU GETTING WHAT YOU ARE PAYING FOR WHEN IT COMES TO CYBER LIABILITY INSURANCE?") market is facing three significant challenges. Insurance underwriters rely on a highly manual, point-in-time approach to gathering data and assessing a company’s [cyber risk](https://www.financedigest.com/using-threat-intelligence-to-minimise-cyber-insurance-risks.html "Using Threat Intelligence to Minimise Cyber Insurance Risks") exposure. However, these underwriters cannot correlate loss data to vulnerabilities, deficient controls, misconfigured hardware or software, or the ability of an attacker to compromise a [critical application or system successfully](https://www.financedigest.com/five-critical-tips-to-create-a-successful-start-up.html "Five Critical Tips To Create A Successful Start-up"). Security assessments are conducted just once before binding coverage and not revisited until it’s time to renew the policy. In many cases, [security assessments conducted on behalf of an underwriter are never shared with the company](https://www.financedigest.com/5-ways-to-protect-your-company-from-cyber-security-threats.html "5 Ways to Protect Your Company From Cyber Security Threats") seeking insurance. As a result, a critical [vulnerability in the industry](https://www.financedigest.com/how-the-financial-services-industry-can-solve-the-issue-of-vulnerable-code.html "How the financial services industry can solve the issue of vulnerable code") is evident. **Manual Risk Assessments** It’s hard to believe, but just one year ago, most cybersecurity insurance questionnaires consisted of less than ten questions, and underwriters would [give companies 60 to 90 days to get the required controls](https://www.financedigest.com/giving-women-the-power-to-make-money-and-take-control-of-their-destiny.html "Giving women the power to make money and take control of their destiny") in place. Today, most applications involve dozens of questions, are still highly manual, and companies only get 30 days to get their security controls in order. Today’s manual application process means underwriters are writing policies based on guesswork that is only valid on the day it was produced. Thus, the requirement to automate the quantitative process could not be more urgent. Automated [cyber risk](https://www.financedigest.com/minimising-supply-chain-cyber-risks-by-asking-the-right-questions.html "MINIMISING SUPPLY CHAIN CYBER RISKS BY ASKING THE RIGHT QUESTIONS") quantification is now a reality. Businesses should move quickly to understand their business more accurately and prioritise efforts so that critical business processes, applications, and [data are protected](https://www.financedigest.com/aon-introduces-new-cyber-solution-in-response-to-eu-regulation-on-data-protection.html "Aon introduces new cyber solution in response to EU regulation on data protection"). Security Orchestration, Automation, and Response (SOAR) can provide three specific benefits. It enables companies to proactively [model and predict risk](https://www.financedigest.com/aon-launches-new-catastrophe-model-to-manage-the-risk-of-icelands-most-disastrous-peril-earthquake.html "Aon launches new catastrophe model to manage the risk of Iceland’s most disastrous peril: Earthquake"), mitigate and monitor for changes and see ‘what-if’ recommendations that drive smart actions, mitigations, and response. ## **Correlation & Accounting for the Attacker** Cybersecurity [insurance](https://www.financedigest.com/ten-things-youre-doing-that-are-invalidating-your-car-insurance.html "TEN THINGS YOU’RE DOING THAT ARE INVALIDATING YOUR CAR INSURANCE") is different from other forms of insurance primarily because cyberattacks involve two things insurance can’t measure — the attacker and the defences they try to beat. The struggle to [understand loss exposure in cybersecurity isn’t the lack of loss data](https://www.financedigest.com/how-data-visualisation-is-helping-the-insurance-sector-understand-environmental-risks.html "How data visualisation is helping the insurance sector understand environmental risks") – it’s the lack of being able to correlate it to a vulnerability, a deficient control, a misconfigured software or hardware, or the ability of an attacker to reach a critical system or application. Risk quantification automatically enters [data](https://www.financedigest.com/trendrating-1-3-delivers-faster-data-analysis-and-enhanced-risk-control-tools.html "Trendrating 1.3 delivers faster data analysis and enhanced risk control tools") into a risk model and automation engine. Those inputs include [data from your organisation](https://www.financedigest.com/auditing-in-cyber-how-organisations-can-keep-track-of-their-data.html "AUDITING IN CYBER: HOW ORGANISATIONS CAN KEEP TRACK OF THEIR DATA") as well as industry, attack, and vulnerability data aggregated through various sources. That information is then applied to the risk model and automation engine to determine the financial impact of cyber [risks and the probability of success of specific attacks](https://www.financedigest.com/preventing-an-operationally-crippling-ransomware-attack-do-you-know-where-your-risk-exposure-lies.html "PREVENTING AN OPERATIONALLY CRIPPLING RANSOMWARE ATTACK – DO YOU KNOW WHERE YOUR RISK EXPOSURE LIES?"). These [calculations drive a variety of other activities within risk](https://www.financedigest.com/how-can-savers-calculate-their-risk-appetite.html "How can savers calculate their risk appetite?") quantification that lead to the operationalisation of information across the rest of your organisation, including: - Prioritisation of [vulnerabilities – not only by CVSS score but by relevance in terms of the financial impact to your business](https://www.financedigest.com/why-your-business-is-vulnerable-to-supplier-fraud.html "Why Your Business is Vulnerable to Supplier Fraud"). - What-if’ analysis to help you understand what specific effects certain changes may have on your [cyber risk](https://www.financedigest.com/amid-evolving-cyber-risks-aon-introduces-first-of-its-kind-enterprise-wide-cyber-solution-for-all-industries.html "Amid Evolving Cyber Risks, Aon Introduces First-Of-Its-Kind Enterprise-Wide Cyber Solution For All Industries") before making those changes. - Producing short- and long-term recommendations on how specific changes may affect Annual Loss Expectancy (ALE) and provide guidance into any ‘low hanging fruit’ that may exist. ## **Cyber Risk Assessments** Given the [advanced capabilities of cyber](https://www.financedigest.com/uks-morgan-advanced-materials-reports-cyber-security-incident-on-its-network.html "UK’s Morgan Advanced Materials reports cyber security incident on its network") adversaries and their tactics, techniques, and procedures, the current cyber insurance model almost guarantees that insurance carriers will be forced to pay claims. As a result, point-in-time assessments that are manual guesswork are inadequate for [protecting enterprises from the onslaught of cyberattacks](https://www.financedigest.com/protecting-the-uk-financial-services-sector-from-cyberattacks-now-and-in-2023.html "Protecting the UK financial services sector from cyberattacks now and in 2023"). Being able to track cyber financial risk over time, understand the impact of budget decisions, and ultimately justify spending is now driving [business decisions on which risks](https://www.financedigest.com/aon-assists-freddie-mac-to-reach-5bn-risk-transfer-milestone-for-u-s-mortgage-credit-business.html "AON ASSISTS FREDDIE MAC TO REACH BN RISK TRANSFER MILESTONE FOR U.S. MORTGAGE CREDIT BUSINESS") to tolerate, treat or transfer. While the first step is to understand your organisation’s exposure in financial terms, the next is to decide how to [mitigate risk](https://www.financedigest.com/mitigating-operational-risk-through-centralising-reconciliation.html "MITIGATING OPERATIONAL RISK THROUGH CENTRALISING RECONCILIATION"). Risk quantification models many different types of attackers and attacks that may infiltrate an organisation, its controls, vulnerability data and critical applications. Most risk quantification customers have their controls actively updated in the tool to assess which applications are most vulnerable. Still, they also provide vulnerability [data that allows risk](https://www.financedigest.com/your-real-risk-appetite-could-be-hidden-in-your-unstructured-data.html "Your real risk appetite could be hidden in your unstructured data") quantification to provide short-term recommendations on Common Vulnerabilities and Exposures (CVEs). The capabilities of risk quantification can give [insurance underwriters and their clients a clear](https://www.financedigest.com/post-brexit-insurance-reform-clear-before-december-says-boes-woods.html "Post-Brexit insurance reform clear before December, says BoE’s Woods") picture of inherent and residual risk in a dynamic fashion. Not only is the threat landscape and the parts of it that are relevant to your business changing, but the controls, applications, endpoints, and type of data present in your environment are changing as well. Risk quantification enables you to apply these changes instantaneously to your models, allowing [cyber risk](https://www.financedigest.com/aon-announces-agreement-to-acquire-risk-management-firm-creating-a-comprehensive-cyber-risk-management-advisory-group.html "Aon announces agreement to acquire risk management firm, creating a comprehensive cyber risk management advisory group") measurement to move beyond point-in-time assessments and become programmatic. Once finalised, analysis is put in a report that business leaders, board members, and [insurance underwriters](https://www.financedigest.com/the-glorious-twelfth-what-underwriters-should-be-doing-as-the-insurance-act-comes-into-force.html "The Glorious Twelfth: What Underwriters Should Be Doing As the Insurance Act Comes Into Force") can understand. --- This blog is powered by Superblog. Visit https://superblog.ai to know more. ---