A Retailer's Cyber Risk Model: Correcting the Annualized Loss Figure
Cobalt Ridge, a $480M-revenue online retailer, earns 61% of revenue between 15 November and 31 December. A consultant's cyber risk model reports annualized loss of $11.8M, computed as the average of the firm's only two recorded incidents over three years: a $2.1M business email compromise and a $21.5M loss from a payment-processor outage that straddled Black Friday. The model uses a three-year lookback, excludes events that did not occur, applies no scenario for an order-platform outage during peak, and reports a single point estimate with no confidence range. The CFO wants to use the $11.8M figure to set next year's insurance limit and to decide whether a $3M segmentation project is justified.
1. Identify the errors in the consultant's $11.8M annualized figure and produce a defensible alternative, stating your assumptions.
Read the worked answer
Three errors. (1) Aggregation: averaging two observed severities is not annualized loss. Expected annual loss is frequency times severity per scenario, so the two events over three years contribute roughly ($2.1M + $21.5M) / 3 ≈ $7.9M - and even that only if the two belong to one homogeneous process, which they do not. (2) Pooling unlike scenarios: a BEC and a peak-season processor outage have different frequencies, different severity drivers and different controls, so they must be modeled separately and summed. (3) Truncation: by counting only events that happened, the model silently assigns zero probability to the scenario that matters most - an order-platform outage inside the Nov 15–Dec 31 window.
A defensible structure, with assumptions stated: BEC at roughly 0.3 per year frequency and about $2M severity → ~$0.7M; peak-season platform outage at 8–10% annual probability with $30–40M of at-risk gross profit over an eight-day outage → $2.5–4M expected loss; plus a small allowance for lower-severity items. That yields roughly $4–6M expected annual loss, with a 1-in-20-year loss well above $30M - the number the CFO actually needs.
2. The CFO wants one number. Explain what to give her instead, and how to handle the tail given only three years of internal data.
Read the worked answer
Give her two numbers and a rule for using each: an expected annual loss for budgeting and program prioritization, and a tail estimate (95th or 99th percentile annual loss) for limit-setting and risk appetite. With three years of internal data and two events, the firm has almost no information about the tail, and fitting a distribution to n=2 is not analysis.
Practical substitutes: structured scenario analysis with business owners (what an eight-day peak-season outage costs per day at contribution margin, including SLA credits and customer loss); external loss data and industry benchmarks to calibrate frequency; and expert elicitation with documented ranges instead of a false point estimate. Present results as a range, and label clearly which inputs are data and which are judgment. The key discipline is that the assumptions get recorded so the model can be challenged and updated at each renewal - a model the CFO can interrogate is more useful than a precise-looking single figure that no one can defend in front of the board or an underwriter.
3. The $3M segmentation project is being justified against the $11.8M figure. What is wrong with that comparison, and how should the business case be reframed?
Read the worked answer
The comparison treats annual expected loss as if it were the project's benefit, which overstates it several times over. Segmentation reduces the severity of some scenarios by some amount, and only for the subset where lateral movement is the loss driver. It also ignores that other controls compete for the same dollars and that a $3M capital project has a multi-year life and operating cost.
Reframe: for each scenario in the model, estimate loss with and without segmentation, weight by probability, and sum the difference - that is the risk reduction. Compare it with the project's total cost of ownership (implementation, operational friction, staff time) and with alternative uses of the budget (identity hardening, EDR, backup re-architecture). If the estimate is highly uncertain, phase the project and treat the pilot as an information purchase rather than a control deployment.
Also make the qualitative argument explicitly: segmentation reduces the chance that a single compromised laptop becomes a nine-figure event. That is a risk-appetite argument, not an expected-value one, and it should be scored separately rather than laundered into the expected-loss arithmetic.