Actuarial Cyber Risk Quantification
Üsta works with the insurers, brokers, security firms and advisers who carry, place and manage cyber risk for other businesses. We supply an independent estimate of the loss, in money, with its basis stated, and the decisions it informs stay yours.
The annual loss a business has a given chance of exceeding. The same curve serves the underwriter, the broker and the board.
Built for the firms that carry, place and manage cyber risk
Partners
An insurer pricing a risk, a broker placing it, a security firm selling the fix and an adviser reporting on it all need the same thing: what the exposure is worth. Üsta produces it once, independently, in a form each of them can use.
Underwrite cyber on a frequency and severity estimate for each applicant, built from their business profile and security questionnaire and corroborated against an independent external view. Üsta supplies the exposure; the rating and pricing decision stays yours.
Learn moreGo into a placement or a renewal with your client's cyber exposure expressed in money, so the limit, excess and cover conversation starts from a figure the client and the underwriter can both follow.
Learn moreRun an independent estimate of a prospect's cyber exposure yourself and put it in front of the buyer, with what your own control area is worth, before the first meeting.
Learn moreAdd a cyber exposure figure to the compliance, governance, audit and assurance work you already do for clients, without becoming a cyber risk modeller yourself.
Learn moreBring a borrower's or investee's cyber exposure, in money, into credit, investment and portfolio decisions, alongside the financial risks you already measure.
Learn moreTechnology platforms that want an Üsta figure inside their product, and firms holding incident or loss data that would sharpen the model. Tell us what you do.
Start a conversationWhy Partners Work With Üsta
The model does not know who is buying, selling or placing what, and no result is adjusted to suit a deal. That is why an insurer, a broker and the client can all sit in front of the same figure and argue about the decision instead of the arithmetic.
Frequency and severity, combined into a loss distribution, the way every other insured risk is already measured. Every figure carries its range and what it rests on. Where the evidence is thin, the range widens and the page says why.
Üsta starts from an independent external view of the organisation and a structured profile of its business and controls. Security artefacts narrow the estimate when they exist. They are not a precondition for producing one.
Üsta's outputs are an input to your underwriting, your advice or your proposal, and the decision stays with you. A client you introduce works with both of us, on terms agreed once, in writing.
What The Model Produces
Cyber sits on the risk register rated High. A premium, a limit or an appetite cannot be set in Highs.
Probability-weighted, in money. The baseline a budget, a limit or a proposal sits against.
What a severe year could cost, not just an average one (VaR and TVaR).
What improving each control area is worth in reduced expected loss. The cost of the fix is yours to set.
Data breach, ransomware, cyber fraud, outage and third-party failure, each modelled separately in money.
Illustrative output formats. Every figure is built from the assessed organisation’s own exposure and controls.
For Enterprises
The same model works directly for the organisations carrying the risk. Credit, market and operational risk are governed in money. Üsta puts cyber on the same footing, so budget, insurance cover, risk appetite and board reporting can run off one number.
Any evidence you already hold, from penetration tests to ISO 27001 and SOC 2 reports, feeds the model. None of it is required to start.
Request a Scoping CallA Method You Can Question
Üsta's method is set out in public, in front of the audiences best placed to challenge it. Built in Cape Town, designed to travel to any market where cyber loss data is thinner than the decisions that depend on it.
Insight
Joint Standard 2 of 2024 places responsibility for cyber risk oversight with the governing body. What that obligation asks of a board, and of the advisers who support it.
Partners: we will work out which part of your business this fits and set out the terms in writing. Enterprises: a 30-minute scoping call to assess fit.