Skip to content

FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

Measuring and Quantifying Cyber Risk for FRM Part II

Updated 11 October 2026 · Fact-checked

Quantifying cyber risk means turning a threat into an expected and a severe loss figure. You estimate how often a loss event happens and how large it is, using scenario analysis, loss data and expert judgement. Key risk indicators track changes over time, and cyber insurance transfers part of the residual loss.

Understand Measuring and Quantifying Cyber Risk

Cyber risk is a form of operational risk. It is hard to measure because loss data is thin, attackers adapt, and one event can hit many firms at once. Even so, a risk manager must give the board a number it can use to set appetite, fund controls and buy insurance.

Most quantification starts with a simple idea: risk = how often a loss event occurs × how much it costs when it does. The FAIR (Factor Analysis of Information Risk) approach breaks this down. Loss event frequency comes from how often a threat acts and how likely it is to succeed against your controls. Loss magnitude splits into primary losses (response, restoration, lost revenue) and secondary losses (fines, litigation, customer loss, reputation). Each input is a range, not a single number, and is often run through simulation to give a loss distribution.

Scenario analysis builds a specific, plausible event, such as ransomware on a core payments system or theft of customer data. Experts estimate frequency and severity for it, including a severe but plausible case. It is useful where history is short, and it feeds stress testing and capital views. Its weakness is subjectivity and bias, so you need structured workshops, challenge and documented assumptions.

Key risk indicators (KRIs) are forward-looking metrics with thresholds. Examples: mean time to patch critical vulnerabilities, share of systems missing patches, phishing click rate, failed privileged-access reviews, and mean time to detect and contain incidents. KRIs do not give a loss figure. They show whether the control environment is getting better or worse, and they trigger escalation when a limit is breached.

Cyber insurance transfers part of the loss, such as response costs, business interruption and liability. Policies have limits, retentions (deductibles), exclusions and sometimes sub-limits. Insurance does not remove the risk. Residual risk remains from gaps in cover, exclusions, counterparty risk and reputational damage that is not insured. Aggregation risk, where one event hits many insureds, also limits the market's capacity.

Key formulas to remember

Annualised loss expectancy
Expected annual loss = Loss event frequency × Loss magnitude per event
Use expected values per year. Frequency is events per year, magnitude is the average cost per event.
FAIR loss event frequency
Loss event frequency = Threat event frequency × Vulnerability
Vulnerability is the probability that a threat event becomes a loss event, given the strength of controls.
FAIR loss magnitude
Loss magnitude = Primary loss + Secondary loss
Secondary loss includes fines, legal costs and stakeholder reactions.
Net loss after insurance
Net loss = Gross loss − Insurance recovery, where recovery = min(max(Gross loss − Retention, 0), Policy limit)
Apply the retention first, then cap at the limit. Check for exclusions and sub-limits.
Residual risk
Residual risk = Inherent risk − Effect of controls and risk transfer
A conceptual relationship, not an exact arithmetic subtraction in every framework.

How to solve Measuring and Quantifying Cyber Risk questions

Use this order for any question on measuring cyber risk, whether it is numerical or conceptual.

  1. 1Identify what is asked: a frequency, a loss amount, an indicator choice, or an insurance effect.
  2. 2Define the scenario or asset at risk and the threat involved.
  3. 3Split the problem into frequency (threat events and vulnerability) and magnitude (primary and secondary losses).
  4. 4Do the arithmetic in the right order: frequency × magnitude, then apply retention and limit if insurance is involved.
  5. 5Check which method fits: scenario analysis for rare severe events, KRIs for monitoring, loss data for frequent small events.
  6. 6Interpret the result: expected versus severe loss, and what residual risk remains after controls and insurance.
  7. 7Eliminate options that treat KRIs as loss estimates or insurance as removing risk.

Quickest way: Frequency × severity, then insurance layers

When to use it: For numerical MCQs on expected loss or net loss after cover.

  1. Write frequency per year and loss per event.
  2. Multiply to get expected annual loss.
  3. For insurance, subtract the retention from the gross loss, cap at the policy limit, and subtract the recovery from the gross loss.
  4. Scan the options for the one matching the right step order and unit.

Common mistakes in Measuring and Quantifying Cyber Risk

  • Treating KRIs as a measure of expected loss.

    Both appear in the same dashboards and are called risk measures.

    Fix: KRIs are leading indicators with thresholds. Loss figures come from FAIR-type estimation, loss data or scenarios.

  • Ignoring secondary losses.

    Candidates stop at response and restoration costs.

    Fix: Add fines, legal costs, customer loss and reputation effects to loss magnitude.

  • Applying the policy limit before the retention.

    Candidates cap the gross loss first.

    Fix: Subtract the retention first, then cap the result at the limit.

  • Saying insurance eliminates cyber risk.

    Transfer is confused with removal.

    Fix: Insurance covers part of the financial loss only. Exclusions, limits and non-insured damage leave residual risk.

  • Using a single point estimate as the answer to uncertainty.

    Numerical exams reward one number.

    Fix: Recall that FAIR uses ranges and simulation. A point estimate is only an expected value, not the severe tail.

  • Relying only on past loss data for scenario design.

    History feels objective.

    Fix: Cyber threats change fast and data is limited. Combine internal events, external data and expert judgement.

Worked examples

Example 1

A bank estimates that a threat actor attempts to breach a customer database 20 times a year. Controls mean 5% of attempts succeed. Each successful breach costs $2,000,000 in primary losses and $1,000,000 in secondary losses. What is the expected annual loss?

Show the solution
  1. Threat event frequency = 20 per year.
  2. Vulnerability = 5% = 0.05.
  3. Loss event frequency = 20 × 0.05 = 1 per year.
  4. Loss magnitude = $2,000,000 + $1,000,000 = $3,000,000.
  5. Expected annual loss = 1 × $3,000,000 = $3,000,000.

Answer: $3,000,000 per year

Example 2

A firm has a cyber policy with a $500,000 retention and a $5,000,000 limit. A ransomware event causes a covered gross loss of $4,000,000. What is the firm's net loss?

Show the solution
  1. Loss above retention = $4,000,000 − $500,000 = $3,500,000.
  2. This is below the $5,000,000 limit, so recovery = $3,500,000.
  3. Net loss = $4,000,000 − $3,500,000 = $500,000.

Answer: $500,000, equal to the retention

Exam tips

  • Read whether the question asks for frequency, magnitude or the net amount after insurance. Many wrong options answer a different question.
  • Match the tool to the use: scenarios for severe rare events, KRIs for monitoring and escalation, FAIR for a loss distribution.
  • For insurance numbers, always apply retention, then limit, then check exclusions.
  • Be ready to name limitations: data scarcity, subjectivity, aggregation risk and changing threats.
  • In interpretation questions, mention residual risk after controls and transfer.

Practice questions from Case Study: Cyberthreats and Information Security Risks

Measuring and Quantifying Cyber Risk: frequently asked questions

What is the FAIR model in simple terms?

FAIR is a framework that breaks cyber risk into loss event frequency and loss magnitude. Each is built from smaller factors, such as threat frequency, vulnerability, and primary and secondary losses. Inputs are usually ranges and often run through simulation.

How is scenario analysis used for cyber risk in banks?

A bank defines a specific plausible event, such as a ransomware attack on a key system. Experts estimate how often it could occur and how large the loss could be, including a severe case. The results support capital, stress testing and control decisions.

What are good key risk indicators for cyber security?

Common examples are time to patch critical vulnerabilities, share of unpatched systems, phishing test results, privileged access exceptions and time to detect and contain incidents. Each should have a threshold that triggers escalation.

Does cyber insurance remove cyber risk?

No. It transfers part of the financial loss, subject to retention, limits and exclusions. Residual risk stays, including uninsured losses and reputational damage.