Session 17: Cyber Risk & Cyber Insurance

2. What is Cyber Insurance?

Cyber insurance is a specialised insurance product designed to protect organisations against financial losses from cyber incidents. Unlike standard property or liability policies, which explicitly exclude cyber events (the "cyber exclusion" clause introduced in most general liability policies post-2013), cyber insurance provides dedicated coverage for the unique risks of the digital economy.

2.1 First-Party vs. Third-Party Coverage

Cyber insurance policies are structured around two broad categories of coverage:

2.2 Common Exclusions

Every cyber insurance policy has exclusions — losses that are not covered. The most important ones to understand:

• War and state-sponsored attacks: Most policies exclude losses caused by "acts of war" — but the definition of "war" in the cyber context is fiercely debated (see Section 6). Some newer policies offer "back" coverage for state-sponsored attacks at an additional premium.
• Infrastructure failure: Losses caused by a failure of public infrastructure (power grid, internet backbone, cloud provider outage) are typically excluded — unless the failure was caused by a covered cyber attack.
• Prior known breach: If the organisation knew about a security vulnerability or ongoing breach before the policy inception but did not disclose it, losses from that breach are not covered.
• Intentional acts: Losses caused by the insured's intentional or criminal acts — including knowingly violating security policies or failing to implement required security controls after a known vulnerability was identified.
• Improper collection of data: Losses arising from collecting data without proper consent — this is increasingly relevant under the DPDP Act.

4. Cyber Risk Assessment Framework

Cyber risk assessment is the process of identifying, quantifying, and prioritising cyber risks to inform insurance underwriting, security investment, and risk management decisions. The NIST Cybersecurity Framework (CSF) — developed by the US National Institute of Standards and Technology — is the most widely adopted framework globally and has been increasingly adopted by Indian insurers and their corporate clients.

4.1 The NIST Cybersecurity Framework

NIST CSF organises cybersecurity activities into five concurrent and continuous functions. Together, they provide a comprehensive view of an organisation's cyber risk posture:

5. Building a Cyber Risk Matrix in Excel

A cyber risk matrix is a structured tool that helps an organisation (or an underwriter) assess and quantify cyber risks across multiple threats and business units. The output is a risk score for each threat-entity combination, an aggregate risk exposure for the organisation, and — in an insurance context — a recommended premium for the cyber insurance policy.

5.1 The Risk Matrix Structure

The risk matrix maps threat types against industry sectors (or departments within an organisation). Each cell represents the risk score for that combination:

CYBER RISK MATRIX — SecureSure General Insurance (Hypothetical)

Threat types:
1. Ransomware
2. Data Breach (External)
3. Insider Threat (Malicious + Accidental)
4. BEC / Payment Fraud
5. DDoS
6. Supply Chain / Third-Party

Risk Score = Likelihood (1-5) × Impact (1-5)

Likelihood criteria:
1 = Very Low (< 1% annual probability)
2 = Low (1-5%)
3 = Medium (5-15%)
4 = High (15-30%)
5 = Very High (> 30%)

Impact criteria (financial loss):
1 = Negligible (< ₹10L)
2 = Minor (₹10L-₹1Cr)
3 = Moderate (₹1Cr-₹5Cr)
4 = Major (₹5Cr-₹25Cr)
5 = Catastrophic (> ₹25Cr)

5.2 Building the Matrix in Excel

Step 1 — Set up the structure: Create a worksheet with threat types as rows and industry sectors (or departments) as columns. Create a corresponding sheet for likelihood scores and another for impact scores.

' Sheet 1: LIKELIHOOD (L) — Example scores for an Indian IT/ITeS company

' Cell range B2:G2 (Threats):
| Threat              | Ransomware | Data Breach | Insider | BEC  | DDoS | Supply Chain |
| LIKELIHOOD (1-5)   |     4      |      4      |    3    |  4   |   2  |      3       |

' Enter likelihood values in row 3 (adjust for the specific organisation):
=4 for Ransomware (high probability for most organisations)
=4 for Data Breach (high probability for IT/ITeS companies handling client data)
=3 for Insider Threat (medium probability, depends on workforce size and controls)
=4 for BEC (high probability — BEC is pervasive)
=2 for DDoS (lower probability for SMEs, higher for large enterprises)
=3 for Supply Chain (medium — relevant for companies with significant third-party dependencies)

' Sheet 2: IMPACT (I) — Same threat/sector structure

| Threat              | Ransomware | Data Breach | Insider | BEC  | DDoS | Supply Chain |
| IMPACT (1-5)       |     4      |      5      |    4    |  3   |   2  |      4       |

' =4 for Ransomware (can be major — systems downtime, data loss, recovery costs)
' =5 for Data Breach (catastrophic for IT/ITeS — client data exposure, DPDP liability, reputational)
' =4 for Insider Threat (major — insider with data access can cause significant damage)
' =3 for BEC (moderate — limited to financial transfer amount)
' =2 for DDoS (minor to moderate — downtime cost, but usually short-lived)
' =4 for Supply Chain (major — can cascade through the organisation's customer base)

' Sheet 3: RISK SCORE = L × I

| Threat              | Ransomware | Data Breach | Insider | BEC  | DDoS | Supply Chain | TOTAL |
| RISK SCORE         |     16     |      20     |   12    |  12  |   4  |      12      |  76   |

' Formula: =B_Likelihood * B_Impact
' =4×4=16 for Ransomware
' =4×5=20 for Data Breach ← Highest risk
' =3×4=12 for Insider Threat
' =4×3=12 for BEC
' =2×2=4 for DDoS
' =3×4=12 for Supply Chain

' Total inherent risk score = SUM(Risk Scores) = 76 (out of a possible 150 = 6×25)

' Conditional formatting: >15 RED (Critical), >8 YELLOW (High), <8 GREEN (Low)

5.3 Premium Calculation

Once the risk matrix is built, the risk scores feed into a premium calculation. A simplified approach:

' Sheet 4: PREMIUM CALCULATION

' Input parameters:
| Parameter               | Value      | Source                                      |
| Organisation Revenue     | ₹500 Cr    | Financial statement                          |
| Requested Limit          | ₹25 Cr     | Customer's desired coverage                  |
| Risk Score Total         | 76         | From Risk Matrix                             |
| Base Rate                | 2.5%       | Market rate for this industry/size           |
| Control Score (0-100)    | 65         | From NIST assessment (higher = better)       |

' Premium calculation:
| Component               | Formula                            | Value      |
| Base Premium            | =Requested_Limit × Base_Rate        | ₹62.5 L    |
| Risk Score Loading      | =Risk_Score_Total / 100 × 30%      | +22.8%     |
| Control Discount        | =Control_Score / 100 × 20%         | -13.0%     |
| Final Loading Factor    | =1 + Risk_Loading - Control_Discount| 1.098      |
| Final Premium           | =Base_Premium × Final_Loading      | ₹68.6 L    |

' Interpretation: The organisation's high risk score (76) adds a 22.8% loading,
' but its decent control environment (65/100) earns a 13.0% discount.
' Net loading: 9.8%. Final premium: approximately ₹68.6 lakh for ₹25 crore limit.

5.4 Cyber Risk Matrix in Python — Quick Analysis

import pandas as pd
import numpy as np

# Define threats and their likelihood/impact
cyber_risks = pd.DataFrame({
    'threat': ['Ransomware', 'Data Breach', 'Insider Threat', 'BEC/Payment Fraud',
               'DDoS', 'Supply Chain Attack', 'Cloud Misconfiguration', 'Phishing/Social Engineering'],
    'likelihood': [4, 4, 3, 4, 2, 3, 3, 5],
    'impact': [4, 5, 4, 3, 2, 4, 4, 2],
    'industry': ['All', 'IT/ITeS', 'All', 'All', 'Online Business', 'IT/ITeS', 'All', 'All']
})

cyber_risks['risk_score'] = cyber_risks['likelihood'] * cyber_risks['impact']
cyber_risks['risk_level'] = pd.cut(cyber_risks['risk_score'],
                                    bins=[0, 6, 12, 25],
                                    labels=['Low', 'Medium', 'Critical'])

print("=" * 68)
print("CYBER RISK ASSESSMENT — SecureSure General Insurance")
print("=" * 68)
print(f"{'Threat':30s} {'L':>3s} {'I':>3s} {'Score':>6s} {'Level':>10s} {'Industry':20s}")
print("-" * 72)
for _, row in cyber_risks.sort_values('risk_score', ascending=False).iterrows():
    print(f"{row['threat']:30s} {row['likelihood']:>2d}  {row['impact']:>2d}  {row['risk_score']:>4d}   {str(row['risk_level']):10s} {row['industry']:20s}")

total_risk = cyber_risks['risk_score'].sum()
print(f"\n{'─' * 72}")
print(f"{'TOTAL INHERENT RISK SCORE':40s} {total_risk}")
print(f"{'MAX POSSIBLE SCORE':40s} {8 * 25}")
print(f"{'RISK RATING':40s} {'CRITICAL' if total_risk > 50 else 'HIGH' if total_risk > 30 else 'MODERATE'}")

# Premium estimate
requested_limit = 25_000_000  # ₹2.5 Cr
base_rate = 0.025
base_premium = requested_limit * base_rate
risk_loading = total_risk / 100 * 0.30
control_discount = 0.65 * 0.20
final_premium = base_premium * (1 + risk_loading - control_discount)

print(f"\n{'─' * 72}")
print("PRELIMINARY PREMIUM ESTIMATE")
print(f"{'Requested limit:':30s} ₹{requested_limit:>8,.0f}")
print(f"{'Base premium (2.5%):':30s} ₹{base_premium:>8,.0f}")
print(f"{'Risk loading:':30s} +{risk_loading*100:.1f}%")
print(f"{'Control discount:':30s} -{control_discount*100:.1f}%")
print(f"{'Final premium:':30s} ₹{final_premium:>8,.0f}")
print(f"{'Premium as % of limit:':30s} {final_premium/requested_limit*100:.2f}%")