A system to calculate Cyber Value-at-Risk

In the face of increasing numbers cyber-attacks, it is critical for organisations to understand risk they are exposed even after deploying security controls. This residual forms part ongoing operational environment, and must be understood planned if resilience achieved. However, there a lack rigorous frameworks help reason about how their use controls can change nature potential losses face, given an often changing threat landscape. To address this gap, we present system that calculates Cyber Value-at-Risk (CVaR) organisation. CVaR probabilistic density function from cyber-incidents, any threats interest control practice. It take account varying effectiveness controls, consequences propagation through infrastructures, cyber-harms result. We demonstrate utility in real case study by calculating organisation experienced significant cyber-incident. show able produce predictions representative actual financial loss. The presented used insurers offering cyber products better inform calculation insurance premiums, effects using particular setups on reducing exposure cyber-risk.