Cyber risk in financial language: how to translate cyber scenarios into expected losses, VaR and risk appetite

What it is about

Joaquín Galermes, actuary and risk model specialist at Safe-U, presented at the Fourth Annual Risk Conference (September 17, 2026) how to turn cyber risk into figures that a board can use to decide.

The 41 slides start from why a color-coded traffic light does not answer how much to invest or what to address first, introduce the open FAIR standard (Factor Analysis of Information Risk) and its tree of loss frequency and loss magnitude, and apply it to a lead case of a bank with USD 240 million in operating income. The case ends in an expected annual loss, a VaR and a TVaR, in the effect of each control on a different part of the model and in the comparison of two return-on-investment metrics.

Objectives

• Explain why cyber risk expressed in colors does not allow decisions on investment or priorities.
• Present the FAIR method and how a hard estimate is broken into parts that can be estimated.
• Show with a case how expected loss, VaR and TVaR are calculated, and how the effect of controls is evaluated.

Key takeaways

1. A cyber incident cuts across the whole income statement: revenue, liquidity, capital, compliance and operational continuity.
2. FAIR is an open standard of The Open Group and a common vocabulary: it breaks risk into loss event frequency (threat times vulnerability) and loss magnitude (primary plus secondary); it gives a range with its uncertainty, not a certainty.
3. Two sources are not averaged if they measure different things: USD 6.29 million is the total cost of a data breach in the financial sector and USD 1.70 million is the cost of recovering from ransomware without the ransom.
4. In the case, the expected annual loss is USD 1.01 million, but the 95% VaR is USD 4.93 million and the 95% TVaR is USD 7.36 million; the typical year is paid by operations and the bad year by the regulator and customers.
5. Each control moves a different part of the model, and the board question shifts from which risk is red to how much is tolerated, how much to invest and whether things improved.