cyber resilience framework

How Cyber Resilience Tolerates Losses Within Limits

by Rob Brown , Sr Director of Cyber Resilience

The Most Hated Question In Security

After taking an informal and unscientific poll, the most hated security question is, “Are we secure?” Only slightly better is, “Are we secure against known threats?” It’s rarely asked the second way. Both are dreaded – particularly in the boardroom.

An altogether better question is, “Are we resilient?” Or said in business terms, “Are we resilient to plausible losses?” That question brings security and finance together. Now united, they must demonstrate that the business is sustainable in the face of losses.

Finance is responsible for dealing with unexpected, yet plausible, financial losses, managed through insurance (risk transfer) and cash reserves (risk acceptance). Security is responsible for reducing the likelihood of plausible losses through risk mitigation. To the detriment of the business, each often works in isolation.

But risk mitigation, transfer, and acceptance should be designed to work together. They are the most collaborative when they have the same objective – keeping risk within tolerance.  This should be security’s and finance’s shared north star– they just don’t often recognize it. Financial leaders and security experts must define what risk tolerance is together for the sake of the business.

Current Vs Target Security Risk


The Cyber Resilience North Star

What’s our risk tolerance?” Most security leaders hate this question too. Some might say it’s worse than “Are we secure?” Yet you may be surprised to learn that the business already answers this question (in part) when they buy cyber insurance. What they are buying is a limit. A limit is a key piece of the risk tolerance puzzle. Your CFO wants a limit large enough to keep people’s mitts off their capital reserves – within reason.

  • Risk of Exceeding Insurance Limit $20M: 34% Risk of Exceedance

Whether your CFO frames it this way or not, they are saying, “Any impacts beyond our limit will be handled by our cash reserves – our treasury – and we can only take so much of that.” Currently, this is said in isolation to security.

Most likely, they would prefer to say the following, “Our investments in security and insurance combined with our cash reserves (as a backstop) make us resilient to plausible cyber losses. Our strategy does this without incurring the moral hazards of under-investment nor the excesses of fear, uncertainty, and doubt.”

What the CFO is saying, in a qualitative manner, is that risk is being managed to tolerance.

Framing The Tolerance Question Quantitatively

Are you okay with a 34% chance of losing $20 million or more – over the next three years?” Better still, “Are you okay with a 34% chance of losing $20 million with a 20% chance of losing $100 million or more – over the next three years?

What’s wrong with this last question? There is a problem. A big one. A brave soul will invariably say, “It’s relative…risk is relative!” But what we must be asking is, “Relative to what specifically?

Risk is relative to the cash you have on hand. If your reserves are in the billions, then these losses may not be the first thing you think about when waking up. You may be tolerant of these potential losses. However, many companies would find these losses concerning – particularly given the extent of the tail risk.

Tolerance Is Found Through Scenario Modeling

Here’s a thought-provoking question: As stated, over a three-year period, you face a 34% chance of losing $20 Million and a 20% chance of losing $100 Million or more. What might you be willing to pay each year (over three years) to move that to a 10% chance of losing $20M and a 5% chance of losing $100M or more? Note: you may want to read that twice and look at the first graph above.

This type of question cannot be answered by any form of benchmarking. It can only be answered by running numerous strategic scenarios that consider:

  • The cost of a desired insurance limit
  • The cost (and return on) security controls
  • The magnitude and probability of losses potentially impacting reserves

Those scenarios will reflect your company’s value at risk (exposure) and your company’s financial position as it evolves. You and your CFO (at the very least) need to see the potential impacts of different strategy scenarios as a team. Facing these quantitatively, you will recognize risk and cost trade-offs that must be considered before committing to an integrated risk management strategy. Taken together, all of this informs what your tolerance is and how much you should spend to keep risk within it.

Does building resilient strategies that aim to keep risk within tolerance sound important to you? Learn more by signing up for our community webinars or onsite training. For a collaborative and quantitative risk management engagement with our experts, contact us directly at

*Please note: All percentages, risk calculations, and models in this article are for illustrative purposes only.

You might also like

third-party cyber risk management

New Frontier: Cyber Risk Mitigation with Superforecasting

You’re a CISO, bombarded from all sides. New vulnerabilities emerge daily, vendors tout countless security solutions, and your inbox overflows with security alerts. Your skilled analysts are stretched thin, struggling to keep pace with the ever-evolving threat landscape. How do you make sense of it all? How do you prioritize investments, allocate resources, and make […]

third-party cyber risk management

Cybersecurity Essentials: The Role of Vulnerability Management in Building Cyber Resilient IT Systems

Navigating the complexities of cybersecurity requires a strategic approach to mitigate risks and safeguard IT systems. Central to this approach is vulnerability management, a systematic process that identifies, assesses, and prioritizes vulnerabilities within organizations’ infrastructure. Understanding what vulnerability management entails and how it contributes to preemptive cyber defense is critical.  According to a recent report […]

third-party cyber risk management

Mastering Cybersecurity Risk Metrics: A New Way to Think About Cyber Risk

Digital threats are not just possibilities but inevitabilities; understanding and calculating cyber risk is more than a precaution – it’s a necessity. Understanding cybersecurity metrics is essential to safeguarding and improving business operations. Calculating cyber risks simplifies complex issues and empowers professionals to communicate them clearly to improve their organization’s digital security. This requires a […]

third-party cyber risk management

Evolving Cybersecurity: From Risk Management to Cyber Resilience

With an astonishing 95% of cybersecurity breaches attributed to human error, organizations must educate, train, and implement a security foundation for all employees. This staggering statistic highlights the vulnerability of humans within digital infrastructures and underscores the importance of building a security-forward mindset into the culture of resilient businesses.   As cyber threats continue to lead […]

third-party cyber risk management

Counting the Cost: Understanding the Financial Risk of Cybersecurity Breaches

Cybersecurity breaches stand as a relentless challenge for organizations worldwide, causing substantial financial repercussions. As cyber threats advance in complexity, the economic impact on businesses intensifies, affecting everything from upfront costs to sustained financial health.  A thorough investigation into the financial risks posed by cybersecurity breaches reveals the breadth of direct and indirect expenses that […]

third-party cyber risk management

Rewriting the Rules of Cyber Security Risks: Part II

Building Cyber Resilience requires a new approach to assessing, measuring, and managing risk. Traditional thinking from both the security and insurance sectors views risk management in binary silos that either stop an attack or fail to prevent loss. However, the truth is that cyber security risk is significantly more complex. Being resilient to cyber security […]