This estimator expresses ransomware risk exposure as a probability-weighted net financial amount after considering control effectiveness and insurance recovery. It begins with gross incident impact, reduces the modeled probability or impact through security controls, and subtracts expected insurance recovery subject to a deductible and policy limit.
The output is designed for scenario comparison and risk-register discussions. It depends heavily on the quality of probability, impact, control, and insurance assumptions and should not be interpreted as a guaranteed maximum loss.
1. Set baseline risk
Enter the annual probability before the modeled control improvement.
2. Enter gross impact
Use the total financial impact if the scenario occurs.
3. Apply control reduction
Estimate how much the control set reduces annual probability in this simplified model.
4. Describe insurance
Enter the deductible, policy limit, and covered share of eligible loss.
5. Review net exposure
Compare residual probability, net incident impact, and annual probability-weighted exposure.
Residual probability = Baseline probability × (1 − Control reduction)
Expected insurance recovery = min[Policy limit, max(0, Gross impact − Deductible) × Covered share]
Net incident impact = Gross impact − Insurance recovery
Annual net exposure = Residual probability × Net incident impact
This model applies controls to probability only and treats insurance recovery as deterministic. In practice, controls can also reduce severity, and coverage may be disputed or delayed.
The primary result is annual net ransomware risk exposure based on the values entered above.
Use the result as a scenario estimate. Validate material assumptions with operational data, technical documentation, or qualified advisers as appropriate.
Given:
18% baseline probability, $1,500,000 gross impact, 35% control reduction, $100,000 deductible, $1,000,000 limit, and 80% covered share.
Calculation:
Residual probability = 18% × 0.65 = 11.7%. Eligible loss = 1,500,000 − 100,000 = $1,400,000. Covered amount = 1,400,000 × 0.80 = $1,120,000, capped at $1,000,000. Net impact = $500,000. Exposure = 0.117 × 500,000 = $58,500.
Result:
Annual net ransomware risk exposure: $58,500.
Interpretation:
The scenario remains material even after controls and insurance, and the result should be stress-tested for lower recovery or higher severity.
It is the assumed proportional reduction in annual incident probability from the modeled control set.
Policies typically have limits, deductibles, sublimits, exclusions, and coverage percentages that restrict reimbursement.
Yes. To model severity reduction, lower the gross impact or run a separate scenario.
Include it only within the covered share and limit assumptions supported by the policy and scenario.
This version explicitly models control reduction and insurance recovery before calculating probability-weighted net exposure.