Cyber insurance is big business.

But modelling risk is still tough

- 

For an insurance company, responding to natural disasters is all about perspective.

Naturally, it's not a good day for the firm, let alone residents in the areas affected, when a hurricane tears through Miami or a wildfire lays waste to the San Fernando Valley. Even so, thanks to the insurance sector's vast historical datasets, the scale of these terrible events remains somewhat predictable. And if a firm can estimate the losses it could potentially have to cover, it can better determine the price of its premiums along with what types of insurance may be too risky to extend at all.

Modelling a cyber catastrophe is not nearly as straightforward. According to Lloyd's of London, a cyberattack on a major financial services payment system could result in losses of $3.5trn over five years. Ironically, the problem in modelling such an eminently plausible scenario is that it's never happened before. Where underwriters for natural disasters are able to consult centuries of data on death and destruction to quantify risk, cyber insurance experts have no such luxury, instead grasping at disparate data points from literature reviews, recent attacks at a much smaller scale and the endless theorising of an army of cybersecurity industry veterans.

How, then, does the insurance sector make sense of all this noise? First off, it's important to understand that modelling a cyber loss is "materially different" from modelling for property and catastrophic risk, explains Shawn Ram, chief revenue officer for insurance at Coalition, a provider of both cybersecurity insurance and protection. "I think it's one of the reasons why, in today's day and age, we're far more focused on security than in years past."