Cyber risk quantification insurance premium reduction is rarely achieved by a better questionnaire alone. It tends to follow when an institution can show an underwriter a credible, numerical link between a control failure and a financial outcome the board already monitors. This case study describes how four financial institutions in Jeddah approached that task, and what a CFO, CRO or head of risk can take from it ahead of a renewal or a risk-appetite statement.
The details below are presented as a composite of the approach. No institution is identified, and the figures are deliberately omitted: the value lies in the method, not in a headline number.
The problem with recovery-cost estimates
Most ransomware scenarios in renewal submissions are expressed as recovery cost: forensic fees, restoration labour, hours of downtime. These figures are necessary, but they have two weaknesses.
- They are abstract to a board. "Seventy-two hours of downtime" does not map to anything a risk committee tracks.
- They understate the larger exposure for a bank or insurer, which is the loss of customers and earnings after a visible failure of core services.
The four institutions concluded that recovery cost described the smaller part of the loss. What the board actually watches is the number of active accounts and net interest margin. They chose to build the scenario around those measures.
The scenario they modelled
Each institution defined the same severe but plausible event: ransomware that takes the core-banking platform out of service for three days. Rather than stop at the outage, they followed the consequences over the following twelve months:
- the percentage drop in active accounts as customers move primary relationships elsewhere;
- the resulting effect on net interest margin;
- the costs, liability and regulatory penalties that sit alongside those losses.
Because the output was stated in customer and margin terms, finance and risk leaders could challenge the assumptions in language they already use. The assumptions were explicit, which made them easier to defend and to revise.
Mapping the loss to ISO 27001 Annex A 5.30
The scenario was then tied to a specific control: Annex A 5.30 of ISO 27001, which addresses ICT readiness for business continuity. The logic is straightforward. The three-day outage is only credible as a three-day outage if recovery objectives, tested failover and continuity arrangements are what the institution says they are. If those controls are weaker, the outage lasts longer and the churn is larger.
This gave each institution a way to say to an underwriter: this is the loss if the control performs as designed, this is the loss if it does not, and this is the evidence that supports our position. That evidence was the institution's existing business-continuity-management documentation, such as continuity plans, test records and recovery targets. Nothing new had to be invented; it was connected to a number.
For institutions regulated by SAMA, the same scenario also sits comfortably alongside expectations under the SAMA Cyber Security Framework on resilience and continuity, since both the control evidence and the financial narrative are being drawn from the same source.
What the underwriting conversation looked like
The institutions presented the quantified scenario together with their continuity evidence. According to the engagement, this positioned them to negotiate lower retentions and higher sub-limits for business-interruption coverage, and the title of this article reflects the premium outcome reported. We do not repeat figures here beyond what the brief supports, and any institution should expect its own result to depend on its controls, its loss history and the market at the time.
The underlying reason is not mysterious. An underwriter who sees an unquantified risk prices the uncertainty. An underwriter who sees a transparent model, with stated assumptions and evidence behind the control that limits the loss, has less uncertainty to price.
When an institution needs this work
Quantification is worth commissioning when:
- a renewal is approaching and the current limit or retention was set by habit rather than analysis;
- the board is drafting or revising a risk-appetite statement and has no financial scenarios to anchor it;
- the business-interruption sub-limit feels disconnected from what an outage would actually cost;
- the submission to insurers describes controls well but says nothing about financial consequence;
- finance, risk and security teams each hold a different view of the "worst case".
What a good outcome looks like
A good outcome is not a single large number. It is a set of scenarios the board understands, loss estimates broken down by cost category, and a clear comparison of limit and retention options so the decision is deliberate. The board should be able to see why it is buying a particular limit, and the institution should be able to explain that reasoning to an underwriter without improvisation.
How we run Cyber Risk Quantification for Insurance
We estimate the financial impact of your most likely and most severe cyber scenarios, so limits, retentions and budgets rest on numbers the board can trust. The work runs as a project of 4–6 weeks and follows four steps:
- Select: we agree the scenarios that matter to your business, working with business owners.
- Estimate: we estimate costs, interruption, liability and penalties, by cost category.
- Compare: we compare limit and retention options.
- Present: we deliver a recommendation and a board summary.
The deliverables are a scenario loss model, a limit and retention recommendation, and a board presentation. The work is aligned with SAMA CSF and ISO 27001.
Two questions come up often. On method, we use a scenario-based approach aligned with recognized quantification methods, adapted to the data you have. On data, you do not need a great deal of it: we start with what you have and make the assumptions explicit.
Where the output feeds a renewal, our Insurer Questionnaire and Underwriting Support service can complete proposal forms and supplementary questionnaires with you, accurately and consistently, and support underwriting calls. If an incident later occurs, our Cyber Claims and Incident Support helps you meet the policy conditions so the insurer has the evidence it needs to pay.
Next step
If your renewal or risk-appetite review is coming up, the most useful starting point is one scenario expressed in terms your board already tracks. Speak with CISO Consulting about Cyber Risk Quantification for Insurance, and we will help you define that scenario and test it against your continuity evidence.
