Ransomware: Insurance, Controls, or Both
Meridian Regional Bank's risk register lists ransomware at the top: a successful attack is modeled at $9M in recovery and downtime, with 8% annual likelihood. The risk appetite statement caps tolerance at $2M single-event loss and prohibits uninsured losses above that. The insurer offers a $450,000 annual premium for $5M coverage with a $500,000 retention, excluding regulatory fines. A $1.2M endpoint and backup program would cut likelihood to 2%. The board wants the cheapest option that satisfies the appetite statement and asks whether insurance alone suffices. Budget is tight, and the CISO's team has run two tabletop exercises, both showing recovery taking nine days.
1. Does insurance alone satisfy the appetite statement? Justify your answer.
Read the worked answer
No, and three gaps defeat it.
- Uninsured components. The policy excludes regulatory fines, which in banking can be the largest single element of a ransomware event. They count as uninsured loss against an appetite that prohibits uninsured losses above $2M.
- Limit below the modelled severity. Coverage of $5M against a $9M modelled loss leaves up to $4M uninsured before fines and the $500,000 retention are counted.
- It does not restore operations. Both tabletops showed nine days of recovery. The policy pays after the fact, if at all; it does not shorten the outage or protect the customer relationship.
Insurance transfers financial severity. It does nothing to likelihood, and the board's question - 'is insurance alone enough?' - conflates the two.
2. Recommend a response combination and justify it in risk terms the board can act on.
Read the worked answer
Recommend both, sequenced and presented as complements rather than alternatives.
The program attacks frequency: expected loss falls from 0.08 x $9M = $720,000 to 0.02 x $9M = $180,000, a $540,000 annual expected-loss reduction - roughly repaying the $1.2M program over about two and a quarter years before any severity benefit is counted.
Insurance then addresses the severity tail the program cannot eliminate. Size the $500,000 retention so that retention plus uninsured items sit inside the $2M threshold, or accept explicitly that they do not.
Do not let the lower premium be presented as satisfying the appetite statement. Insurance alone leaves 8% likelihood against $9M severity with material uninsured gaps; the program alone leaves a severity tail that could exceed the appetite in a single event.
3. What must the risk register record, and who is entitled to approve the residual?
Read the worked answer
The register entry should carry the gross and residual loss estimates with the assumptions behind them, the identified uninsured components (fines, business interruption above sublimit, reputational effects), the tabletop evidence of nine-day recovery, and the acceptance itself - owner, date, expiry, and review triggers.
On authority: because residual single-event exposure still exceeds the board-approved $2M threshold, acceptance rests with the board or its risk committee. It cannot be delegated to the CISO or the business line, and the CISO should not be placed in the position of approving an appetite breach they do not own.
The practitioner's role is to state the residual plainly, present the options with their expected-loss consequences, and record the decision accurately - not to make it.