Ransomware Investment Case Under a Hard Risk Appetite
Northwind Freight is a 1,150-employee logistics operator with three depots and $180M revenue. Its cyber insurance policy has a $5M limit, a $500k retention and a $1.5M ransomware sublimit, and it requires phishing-resistant MFA for remote access as a condition of cover. The CISO's team modelled ransomware as a single loss expectancy of $1.8M (downtime, recovery, regulatory) with an annualised rate of occurrence of 0.5, based on three years of sector claims data rather than Northwind's own incidents. A proposed $260k/year programme combines EDR, immutable backups, an IR retainer and MFA for all administrators; the team estimates it would cut the ARO to 0.15 without changing the SLE. The board's risk appetite statement says no single event should leave more than $2M uninsured. The CFO has asked whether the programme pays for itself and whether insurance closes the remaining gap. A separate audit finding notes that 14 of 19 domain administrators still use SMS-based MFA.
1. Calculate the pre- and post-control ALE, the net annual benefit, and state clearly what the figures do and do not justify.
Read the worked answer
Arithmetic. Pre-control ALE = SLE x ARO = $1.8M x 0.5 = $900k. Post-control ALE = $1.8M x 0.15 = $270k. Gross risk reduction = $630k; net benefit = $630k - $260k = $370k; benefit-cost ratio = 630/260, about 2.4:1. Because the spend is annual and the benefit is annual, there is no multi-year payback calculation to argue about.
What it justifies. On these assumptions the programme is economically rational and can be approved as a risk-reduction investment rather than a compliance cost. It also reduces the chance that the insurer's ransomware sublimit is exhausted.
What it does not justify. ALE is an expected value; it says nothing about the $1.8M cash-flow shock or the tail. The 0.5 ARO comes from sector claims, not Northwind telemetry, so it is an assumption that should be tested against incident data, control coverage and threat intelligence. The 0.15 post-control ARO assumes the controls are fully operated: EDR that is installed but unmonitored, or immutable backups that are never restore-tested, will not deliver it. The model also excludes reputational loss, contractual penalties and downtime beyond the modelled figure. Present a sensitivity table: at ARO 0.3 post-control, ALE is $540k and net benefit falls to $100k; at ARO 0.4 the programme is roughly break-even. That range is the honest message to the board.
2. Using the appetite statement, assess whether the residual risk after the programme is acceptable once insurance is applied. Show the arithmetic and the conditions you would attach.
Read the worked answer
Apply the policy mechanically. For a loss L, the insurer pays min(L - 500k, 1.5M); Northwind bears the rest. At L = $1.8M the insurer pays $1.3M and the uninsured loss is $500k, inside the $2M appetite. The appetite is breached only when L - 1.5M > $2M, i.e. L > $3.5M. The real question is therefore not the modelled SLE but the credible maximum: if a destructive attack plus regulatory and third-party claims could exceed $3.5M, insurance does not close the gap.
Two conditions before acceptance. First, the policy condition requiring phishing-resistant MFA for remote access is not met while 14 of 19 domain admins use SMS. SMS is exposed to SIM swap and interception, and an insurer could decline or avoid a claim for breach of a warranty. Complete and evidence the MFA work; do not merely schedule it. Second, confirm in writing what the sublimit covers, whether exfiltration triggers it, and whether state-actor or unpatched-vulnerability exclusions apply.
Conclusion. Conditional acceptance is defensible if admin MFA is completed, the credible maximum loss is documented, and either a higher sublimit or lower retention is purchased when that maximum exceeds $3.5M. If none of those hold, residual risk exceeds appetite and the board must formally accept it or fund additional controls. Insurance transfers financial consequence; it does not reduce ARO, so it must not be counted as a control inside the ALE model.
3. The board asks why the 0.15 ARO should be believed. What caveats and evidence would you put in the paper?
Read the worked answer
State provenance first: the 0.5 base rate is external sector data, not observed frequency, so it carries wide uncertainty. The 0.15 figure is a forecast of control effectiveness, not a measurement. Support it with evidence that each control is deployed, configured and exercised: EDR coverage above 98% of endpoints with alert triage within the SOC's SLA; restore tests from the immutable copy each quarter with a recorded RTO; an IR retainer with a named contact and a tabletop completed in the last 12 months; MFA enforced for all administrators with no SMS fallback.
Explain the model's shape. ALE is a mean; the board should also see a plausible worst case and the loss that would breach appetite. Note correlated assumptions: the same domain admin compromise can disable backups and EDR, so controls should not be treated as independent. Show sensitivity: if the ARO only falls to 0.3, net benefit is $100k and the case is marginal; if the SLE is underestimated by 30%, the post-control ALE is $351k.
Finally, define the review trigger. Re-run the model if incident frequency changes, if the insurer alters terms, or if a control fails a test. The paper should say the ARO is a decision aid, not a promise, and that the programme is justified even at the conservative end because it also reduces the severity of events that insurance does not fully cover.