The $2.4M Insurance Bet
A retailer's risk register shows ransomware as a tier-1 risk. Analysts estimate a single-event loss of $6M and an annual likelihood of 40% without additional controls. A proposed endpoint and backup hardening program costs $500k per year and is expected to cut annual likelihood to 15%. Cyber insurance costs $180k per year with a $1M limit and a $250k retention, and excludes regulatory fines and widespread outage. The CFO wants to buy insurance and skip the controls. The board's risk appetite allows no more than $250k expected annual loss from tier-1 risks.
1. Evaluate the CFO's proposal quantitatively.
Read the worked answer
Start with expected annual loss (ALE = single loss × annual likelihood).
- Status quo: $6M × 0.40 = $2.4M ALE.
- Controls only: $6M × 0.15 = $900k ALE, plus $500k program cost = $1.4M.
- Insurance only: premium $180k. Insurance does not change likelihood. With a $1M limit and $250k retention, a $6M event leaves at least $4.75M retained plus the premium. Expected recovery is materially below the ALE.
So the CFO's option reduces neither the chance nor most of the loss. It also leaves uninsured items - regulatory fines and widespread outage - untouched.
The strongest package is controls plus insurance: controls cut expected loss to $900k, and insurance covers the tail above retention. Total cost is $680k plus retained losses. Even combined, expected retained loss likely exceeds the $250k appetite, which means the board is being asked to accept a documented exception, not to believe the number is met.
2. What should the CISO recommend, and with what caveats?
Read the worked answer
Recommend controls plus insurance, sequenced so the controls start now and the policy is bound before renewal.
Caveats to state plainly:
- The $6M and 40% figures are estimates; run sensitivity analysis at, say, 25% and 55% likelihood and $4M–$9M loss. The recommendation should hold across a reasonable range.
- Verify the policy's definitions: what counts as a ransomware event, whether restoration costs and business interruption are covered, whether the insurer controls the forensic vendor, and the sub-limits.
- Confirm the control program's effectiveness assumption is testable - restore tests, EDR coverage, and backup immutability metrics.
- Insurance renewal terms may tighten after a claim; do not treat the policy as a permanent substitute for controls.
The CISO should not present a single-point estimate as certainty; the value is in showing the CFO that insurance transfers only part of the loss and none of the likelihood.
3. Who should accept the residual risk, and how should it be recorded?
Read the worked answer
Residual risk above appetite belongs to the board or its delegated risk committee, not the CFO and not the CISO alone.
Record in the risk register: the scenario, the current estimate with ranges, controls in place, insurance terms, the residual expected loss, and the specific appetite threshold breached. Name the accepting executive and the review date. Attach the sensitivity analysis and the policy exclusions.
Escalate with a decision paper that presents three options: fund the program, accept residual risk explicitly, or reduce scope by de-prioritizing other spending. If the CFO persists, the CISO's obligation is to ensure the acceptance is informed and at the right level - not to win the argument. An undocumented verbal acceptance protects no one after an incident.