Oxford University publishes AXIS white paper on cyber-risk quantification

The Department of Computer Science at Oxford University and AXIS Insurance, a business segment of AXIS Capital Holdings Limited has announced the publication of a white paper titled “Calculating residual cyber-risk” which explores alternative methods of quantifying cyber-Risk. With the publication of this study, Oxford and AXIS invest in the advancement of cyber-risk modelling across cyberthreats to better anticipate, prepare and improve overall cyber resilience.

The research was conducted by Oxford’s Professor Sadie Creese and Professor Michael Goldsmith and sponsored by AXIS. The full white paper, which identifies a preliminary Cyber Value-at-Risk (CVaR) model and articulates key insights from the Department’s preliminary research, can be found HERE. 

Professor Sadie Creese, Department of Computer Science at Oxford University, said: “All organizations face cyberthreats today, and the proposed CVaR helps estimate cyber-risk and allocate resources toward optimal control configuration. The proposed CVaR model is an analytical milestone in research on the quantification of cyber-risk, and we are very pleased to present our early insights today.”

The Department’s research proposes the CVaR model, an evolution of the traditional Value at Risk (“VaR”) methodology which takes into account potential losses, probability of losses, and timeframe.

The CVaR model augments existing analytical solutions by:

• Articulating cyber-risk in financial terms, supporting commercial decision making, and helping create balance between protecting an organization and operating a business
• Generating data that allows businesses to make decisions about their risk appetite, cybersecurity investments, and other risk mitigation and transfer strategies more confidently
• Predicting the potential losses arising from cyberattacks and illustrating the pros and cons of control-mitigation strategies and configurations
• Identifying and quantifying residual risk, helping calculate insurance limits and coverages. The proposed CVaR model builds upon VaR with three additional variables: control effectiveness, control dependencies and harm propagation. The Department has created an algorithm for calculating CVaR for an organization.

Dan Trueman, Global Head of Cyber and Technology at AXIS, added: “Our team at AXIS is proud to continue our longstanding partnership and support of Oxford’s Department of Computer Science in publishing critical research to help improve understanding of cyber-risk quantification and mitigation. Through this partnership and the efforts, we are leading through the AXIS Cyber Centre of Excellence, we are committed to helping combat the significant threats posed by cyber-risk.”

Launched in 2018, the AXIS Cyber Centre of Excellence offers protection and mitigation solutions to counter global cyberthreats and attacks through education and awareness training. For more information, please click HERE.

Authored by AXIS Insurance