Cyber Risk Quantification: Evaluating Providers and Using Results in Insurance Decisions

Cyber risk quantification (CRQ) puts a financial estimate on cyber risk: how likely a loss event is and how much it might cost. Boards find this easier to act on than a heat map, and it can help decide how much cyber insurance to buy, which controls to fund first and how much risk to retain. The weakness is that the result depends heavily on its inputs. Two providers can produce very different numbers for the same organisation, and both can look precise.

CYBORIUM helps Australian organisations compare cyber risk quantification providers and use the results in insurance and investment decisions through a structured vendor-neutral sourcing process. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the service.

Decide which decision the numbers will support

CRQ is bought for different reasons. An organisation reviewing its insurance needs a view of plausible severe losses to set limits and retentions. A security team competing for budget needs a comparison of how much different controls reduce expected loss. A board needs a small set of material scenarios expressed in dollars. Each use needs a different level of detail and a different kind of provider, from software platforms to advisory engagements.

Write down the decision, who will make it and when. That keeps the engagement from producing a large model nobody uses.

Five areas that decide CRQ value

1. Method transparency

Ask how the model works. Many providers use approaches based on the FAIR standard, which separates loss event frequency from loss magnitude. Whatever the method, you should be able to see the assumptions for each scenario and change them. A result you cannot trace to its inputs cannot be defended to a board or an insurer.

2. Data sources

Find out where frequency and cost estimates come from: global incident data, insurance claims data, your own incident history or expert estimates from your staff. Check whether Australian data is used. Published sources such as the ASD Annual Cyber Threat Report and OAIC Notifiable Data Breaches statistics are a reasonable way to sanity-check modelled figures.

3. Scenario relevance

Scenarios should reflect your business: a ransomware outage of your core platform, a breach of customer personal information, business email compromise causing a fraudulent payment, or failure of a key supplier. Ask each provider to show how it would build your top three scenarios and which of your data it would need.

4. Control linkage

For budget decisions, the model needs to show how a specific control changes frequency or impact. Ask how control effectiveness is estimated and whether it can use evidence you already hold, such as Essential Eight maturity assessments.

5. Commercial model and independence

CRQ is offered as software subscriptions, one-off advisory work, or services connected to insurance broking. Understand how the provider is paid. A provider that also earns from placing insurance may be excellent, but the relationship should be disclosed and considered when reading its recommendations on limits.

Using results in insurance decisions

Quantified scenarios help an organisation choose limits and retentions and prepare for underwriting questions. They do not replace reading the policy. Check what the policy excludes, how it treats ransomware payments, business interruption waiting periods, and any requirement to use panel incident response providers. Regulatory obligations such as APRA CPS 234 remain with the organisation whatever the policy covers.

A comparable evaluation

Give each shortlisted provider the same two scenarios and the same basic information about the organisation. Ask for the estimated range of loss, the assumptions and data behind it, and the three controls that would change the result most. Compare how clearly each explains the result and how easily you could update it, as well as the numbers themselves.

Contract points to settle

The agreement should state ownership of the model, assumptions and outputs, confidentiality of the security information you provide, conflicts of interest, and whether you can keep using the model after the engagement ends. For software, confirm data location and export.

CYBORIUM’s role in the decision

CYBORIUM can define the decision the analysis must support, prepare scenarios, coordinate providers, compare methods and disclosures, and support negotiation. The organisation keeps the decision and contracts directly with the selected provider. The guide to incident response services covers the retainer that most policies expect to see in place.

Updated 15 September 2026. This guide explains CYBORIUM’s procurement evaluation method. It does not provide legal, insurance or regulatory advice.

Standards and further reading

Cyber insurance and risk quantification are bought to answer a board question. The inputs matter more than the model.

• OAIC Notifiable Data Breaches. Published breach statistics and obligations, which give a defensible frequency input rather than a vendor estimate.
• ASD Annual Cyber Threat Report. Australian incident costs by organisation size, useful for sanity-checking a modelled loss figure.
• APRA CPS 234. For regulated entities, the obligations that persist regardless of what a policy covers, which is the distinction insurers rely on.

Last updated: 22 October 2026