Lessons learned while modeling rare catastrophic cyber loss events

The speakers, from RMS, a company that builds catastrophe models mostly for insurers and reinsurers, frame cyber risk as a portfolio problem. They separate attritional losses, which hit single organizations, from tail events that strike many firms at once, and show how both feed into an insurance premium calculation.

Their central argument is that frequency and severity statistics cannot estimate extreme events that have never been observed. Instead, their model builds a synthetic world of firms, software, vulnerabilities and threat actors linked by causal mechanisms, then runs it across tens of thousands of simulated years. The talk also covers fitting probability distributions to data, how the addressable population of an attack and chains of required vulnerabilities shape worm-style losses, and data gaps such as short usable time series and sparse incident reporting.

The rarest modeled events, roughly one-in-a-hundred per year, are most likely driven by wormable exploits or supply chain attacks on large vendors, with wipers as the probable payload. Audience questions covered insider threats, which the current model does not include, and whether the approach suits a single firm. The takeaway is that uncertainty in cyber will stay greater than in natural hazards, so expert judgment has to complement any such model.