Probabilistic models for cyber risk
Catastrophe modeling firms have extended the probabilistic techniques used for hurricanes and earthquakes to cyber risk. Instead of relying only on past claims, these models simulate large numbers of possible cyber events and estimate the losses each could cause across an insurance portfolio.
Typical inputs include the industries and sizes of insured companies, their technology dependencies and the types of attacks being modeled, such as cloud outages or widespread malware. The output helps insurers understand accumulation risk and set capital and reinsurance needs.
Because cyber threats evolve quickly, these models are updated frequently and are used alongside expert judgment and scenario analysis rather than as a single answer.