Cyber Risk Quantification for Ransomware Insurance (ISO 27001)

Most boards choose cyber-insurance limits by looking at what peers buy or by accepting the figure a broker suggests. Underwriters, however, price ransomware cover with probabilistic loss models, and your incident-response plan probably never mentions them. For Saudi financial institutions and large corporates, cyber risk quantification for ransomware insurance under ISO 27001 closes that gap: the incident planning you already do becomes the input to a number the board can defend.

This article explains how to build a loss-exceedance curve, step by step, and how to use it to set retention and limit.

Why incident planning is the right starting point

ISO 27001:2022 Annex A control 5.24 asks an organization to plan and prepare for incident management by defining processes, roles and responsibilities. Most organizations treat it as a documentation exercise: a plan, a call tree, a severity matrix.

The same material holds what a loss model needs. A severity matrix already separates minor events from serious ones. Roles and recovery steps already imply how long systems stay down. What is usually missing is money: what each severity band costs, and how likely it is.

For regulated institutions the stakes include supervisory attention. SAMA expects institutions to manage cyber risk under the SAMA Cyber Security Framework, and personal data incidents also engage the Personal Data Protection Law, overseen by SDAIA. A loss estimate should therefore include regulatory exposure alongside operational cost.

What a loss-exceedance curve shows

A loss-exceedance curve plots a loss amount on one axis and the likelihood of losing at least that much in a year on the other. Read it from left to right: small losses are common, large losses are rare, and the curve falls between them.

It answers the question a board really asks: how likely is it that a ransomware event costs us more than a given figure? That is exactly the question a limit and a retention decision turns on.

• The retention is the point on the curve you are willing to fund yourself.
• The limit is the point beyond which you accept residual risk, or seek other transfer.
• The gap between the two is the layer you are paying an insurer to carry.

Step 1: Define three severity bands

Use the severity levels from your incident management plan and tie each to a ransomware scenario. Three bands are enough to start.

1. Contained event. Ransomware affects a limited set of systems, is isolated quickly, and restoration from backup succeeds.
2. Major disruption. A core business platform is encrypted, operations are interrupted for days, and part of the data must be rebuilt or recovered.
3. Severe event. Multiple critical systems and backups are affected, data is exfiltrated, and the institution faces prolonged interruption, supervisory scrutiny and public attention.

Agree the scenarios with business owners rather than IT alone. They know which processes cannot stop and what an hour of interruption really means.

Step 2: Estimate cost by category

For each band, estimate four cost categories separately so each assumption can be challenged.

• Downtime cost. Lost revenue, fees that cannot be earned, manual workarounds and overtime during the interruption. Use the recovery time your plan assumes, then test it against how the business actually operates.
• Data-restoration expense. Forensic investigation, rebuilding systems, recovering data, replacing infrastructure and external specialist fees.
• Regulatory penalties and obligations. Notification effort, regulator engagement, legal advice, and potential penalties where personal or customer data is involved.
• Reputational impact. Customer attrition, additional customer-service load and the cost of recovering trust. This is the hardest to estimate, so state the assumption plainly and show a range.

Express each as a range, not a single figure. A low, likely and high estimate gives the model something to work with and shows the board where uncertainty sits.

Step 3: Assign likelihoods

Attach an annual likelihood to each band. Sources include your own incident history, threat intelligence relevant to your sector, control maturity assessments and the results of recovery testing. Where data is thin, say so and record the assumption. A transparent assumption is more defensible than false precision.

A common concern is that you need large volumes of data. You do not. Start with what you have, make the assumptions explicit, and refine them as evidence improves.

Step 4: Plot the curve

Combine the likelihoods and cost ranges, typically through a simulation across many possible years, into a distribution of annual loss. Plot the loss amount against the probability of exceeding it. The result is a curve you can read at any point.

Mark three things on it:

• the loss level you would tolerate within your risk appetite;
• the expected loss in a typical year;
• the tail, meaning the severe-event region where a single incident could be material to capital or earnings.

Step 5: Use the curve to decide retention and limit

Now compare options against the curve.

1. Set the retention at a loss the institution can absorb without disturbing its plans. The curve shows how often that level is likely to be breached.
2. Test candidate limits by seeing how much of the tail each covers and how much remains with you.
3. Compare the premium of each option with the loss it removes from the curve, not with a peer's limit.
4. Record exclusions, sub-limits and waiting periods, since these change what the policy pays in the severe band.

The audit committee can then see the reasoning: a stated risk appetite, a modeled distribution, and a documented link between them and the structure bought.

Keep the model connected to the incident plan

The curve is only useful if it stays tied to reality. Update it after a recovery test, a material change in architecture, or a significant incident. Make sure the recovery times in the model match those in the plan. Insurers will also ask about controls and incident readiness, so consistent answers across the model, the plan and the proposal form matter. The same evidence supports a claim if one is ever needed, including timely notification and cost records.

From the curve to a board decision

Cyber Risk Quantification for Insurance is the service we provide for this purpose. We estimate the financial impact of your most likely and most severe cyber scenarios, so limits, retentions and budgets rest on numbers the board can trust.

The work follows four stages: select scenarios that matter to your business, estimate costs, interruption, liability and penalties, compare limit and retention options, and present a recommendation and board summary. The deliverables are a scenario loss model, a limit and retention recommendation and a board presentation. The project runs 4–6 weeks. We use a scenario-based approach aligned with recognized quantification methods, adapted to the data you have, and the work is aligned with SAMA CSF and ISO 27001.

If your next renewal is approaching, start with the three severity bands from your incident plan and bring them to a conversation with us.