Author

Asdrubal Picardo

Published

16 July 2026

Estimated Read time

5Mins

Asdrubal Picardo, CEO at Squalify, explains why cyber risk now sits alongside credit, liquidity and operational risk as a driver of enterprise value.

For most of its history, cyber risk was somebody else’s problem – at least, that’s how the boardroom saw it. It lived in IT, spoke in acronyms, and was measured in things boards neither understood nor needed to. Firewalls. Patch cycles. Vulnerability scores. Important, certainly, but not the kind of thing that kept a CFO awake.

That era is over. Cyber risk now sits alongside credit, liquidity and operational risk as a driver of enterprise value. It shapes valuations, influences M&A decisions, and moves shareholder confidence in ways that are very visible and very fast. When something goes seriously wrong, it isn’t logged as an IT incident; it lands in the boardroom as a business crisis with a price tag.

The problem is that most organisations are still trying to govern a 2025 risk with 2005 tools.

How we got here – and why the approach most organisations use isn’t fit for purpose

The discipline has evolved considerably over the past two decades. But that evolution has been uneven, and the methods many organisations still rely on were designed for an earlier set of problems.

Stage one: heat maps and gut feel

For the better part of two decades, cyber risk management was essentially a technical exercise dressed up as governance. Risks were mapped onto colour-coded grids based on control assessments and vulnerability scans. Teams asked whether the firewall was configured correctly, whether patches were current, whether access rights matched the policy.

There was nothing wrong with this, as far as it went. It gave security teams a shared framework. It helped prioritise remediation. But it told you almost nothing that a board could act on. What does “high” actually mean? High compared to what? What would it cost? The heat map couldn’t say. A risk rated red in one business unit and amber in another might represent wildly different financial exposures. Or identical ones. There was no way to tell, and no common unit of account to compare them.

The board got a dashboard. What it needed was an answer.

Stage two: financial quantification, built from the bottom up

The next wave addressed the most glaring gap: it put numbers on risk. Frameworks like FAIR gave analysts a structured way to estimate monetary losses, drawing on probability distributions and loss modelling. For the first time, cyber risk could be expressed in terms that the rest of the business understood. That matters, because when you can denominate risk in money, you can compare it to other risks, weigh it against the cost of controls, and start making defensible decisions.

But the bottom-up approach carried its own limitations, and they’re serious ones. It works at the asset level (individual systems, individual threats, individual control failures) and tries to work upward toward an enterprise view. In practice, this requires granular technical data that is often incomplete, unreliable, or simply unavailable. Building a single quantification can consume months. And the further you zoom out, the more the analysis starts to wobble: aggregating dozens of system-level assessments into a coherent company-level picture is an exercise in compounding assumptions.

The result is analysis that can feel rigorous in its detail while being strategically useless at the level where decisions actually get made. You end up knowing a great deal about the risk inside individual rooms while remaining largely ignorant about the building.

Stage three: start with the business, not the systems

The most recent evolution flips the logic entirely, and it’s the one that finally produces something boards can use.

Instead of starting with IT assets and working up, a top-down approach starts with the business: how does this organisation make money, what would a serious cyber event actually disrupt, and how exposed are those critical functions right now? It calibrates against real-world loss data drawn from insurance markets and large-scale incident histories, rather than from internal workshops and expert estimates. That means it captures what analysts might miss: unknown vulnerabilities, systemic exposures, and the full chain of second-order consequences that bottom-up models routinely undercount.

The outputs look different too. Risk expressed as a potential financial loss at the company or group level, broken down by business unit, tracked over time, and stress-tested against different investment scenarios, is something a board can actually govern. It fits into the same mental model as every other material risk on the register. It enables comparison, accountability, and decisions that can be explained and defended after the fact.

For groups operating across subsidiaries or jurisdictions, this matters even more. A consistent, top-down model makes it possible to compare entities on the same basis, set improvement targets proportionate to actual exposure, and track whether the aggregate risk position is moving in the right direction. Bottom-up methods, stitched together from incompatible local assessments, simply can’t do that.

What this demands of leadership

The shift creates clear obligations, and they run in both directions.

CISOs and CIOs need to stop thinking of financial fluency as someone else’s job. The ability to explain how a specific control investment reduces a measurable financial exposure (not just improves a risk rating) is now a core part of the role. Boards are increasingly asking for it, and those who can’t provide it are increasingly losing the argument for budget. Boards, for their part, should be asking harder questions. Not about the technical detail – that’s management’s job – but about the quality of the evidence behind the numbers. Does the reporting show how exposure has moved over time? Does it flag concentrations of risk? Are the assumptions visible and defensible? A report that can’t answer those questions isn’t risk governance; it’s risk theatre.

The standard has shifted

The principle that risk has to be measurable to be manageable isn’t new. It underpins how serious organisations have governed credit, liquidity and operational risk for decades. Entire disciplines were built on it: stress testing, capital modelling, scenario analysis. The assumption was always that if you can’t quantify an exposure, you can’t really manage it; you’re just hoping.

Cyber is now being held to that same standard. Regulators are demanding it. Insurers are pricing for it. And boards that have watched enough crises unfold in public are no longer willing to accept dashboards as a substitute for answers.

Cyber risk has earned its place at the table. The question is whether the people presenting it are ready to speak the language of everyone else in the room.

Learn more at squalify.com

  • Cybersecurity
  • Digital Strategy

Author

Chris Gunner

Published

4 March 2026

Estimated Read time

4Mins

Chris Gunner, vCSO at Thrive – a leading NextGen MSP/MSSP, delivering global AI, cybersecurity, cloud, compliance, and digital transformation managed services – on how CISOs can position their cyber strategy to to become part of how a business navigates uncertainty

Quantification of cyber risk is a growing trend. While this can be genuinely useful, in practice it is often misunderstood or over-applied by security leaders. It can range from an arbitrary figure to attempting to model every possible risk on the register in a Monte Carlo simulation. The focus can fall on the mechanics of quantification, rather than how financial decision-makers actually use the information.

Think of the CFO – they don’t walk through every penny in the budget. Instead, they usually focus on the board-level levers that can materially affect the business. These often include three key areas: strategic optionality, removing friction from capital events and avoiding shocks and smoothing operating costs. Security conversations should be anchored the same way.

The Importance of Strategic Optionality

If faced with a credible one-year growth plan, CFOs may recommend a one-year office lease despite a 20% premium. This is because it maintains the option later of moving or re-contracting once the growth trajectory becomes more visible. Like most strategic decisions, it is about preserving flexibility in the face of uncertainty, even if that flexibility comes at a short-term cost.

If we apply this to a cyber context, there are often businesses that have taken a calculated gamble with their existing business strategies. While the plan is sound, there is a chance it might not land as expected. When they require security services, the choice between a ‘standard’ and ‘premium’ SOC frames the decision as one of optionality rather than security spend. Paying more now to preserve the ability to adapt later down the line. A simple illustration is incident response. An on-call retainer with defined response times can look more expensive than ad hoc support. Until an incident occurs and procurement becomes the bottleneck. In those moments, flexibility is often far more valuable than marginal savings achieved earlier.

Removing Friction from Capital Events

For CFOs, especially those operating in the alternative investment space, the focus is on structuring capital events. As opposed to managing day-to-day operational costs. One of the most painful points in that process is due diligence. The careful exchange between acquirer and target that aims to provide enough information for each to price risk, without giving the entire game away.

CISOs can materially influence how smooth or painful that process becomes. The most effective support often comes from understanding upfront what the diligence process will look like and preparing accordingly.

For example, they might develop executive-level ‘Security at ACME’ overviews to sit alongside more detailed trust centre or technical reports. Being available to diligence teams for interviews, and for example clearly articulating which services are outsourced to an MSSP, and why, builds credibility between those executive teams.

Decision-makers often don’t look at penetration test reports at a deal level. They are assessing whether the organisation understands its own control environment. A well-prepared CISO who can clearly explain why certain controls exist acts as a trust amplifier during transactions.

It is often the difference between a diligence process that closes cleanly and one that drifts. Two organisations can have similar maturity. Yet the one that can respond within a day with clear, consistent evidence reduces follow-up questions, avoids uncertainty premiums in pricing discussions and prevents security from becoming a late-stage negotiation point.

Avoiding Shocks and Smoothing Operating Costs

For any individual who has worked with a finance partner to define a departmental budget will know that predictability often takes precedence over absolute cost. Contract value can be secondary to payment terms, renewal timing or the ability to forecast spend with confidence.

CISOs can align with this by looking to reduce unplanned operating expenditure. In addition to understanding the cost structure of their controls by communicating with the technical pre-sales engineer, procurement and account teams.

A good example is cyber insurance. While often purchased directly by finance teams, many policies are relatively off-the-shelf and provide access to services the security team already operates or has under contract. Other policies include notable exclusions for the events most likely to occur. Such as a ransomware incident without business interruption cover. In many cases, these gaps can be addressed in-policy with a flat fee or a more predictable cost model.

The value here extends beyond risk transfer and into more predictable costs: replacing reactive spend with planned expenditure.

Aligning Cyber Conversations to Board Priorities

Across all of the above examples, the common thread is that the board is rarely asking security to prove its value in isolation, and is surprisingly comfortable with uncertainty. But they are asking whether the cyber papers support better decisions, fewer constraints and more predictable outcomes for the business as a whole.

CISOs who frame their priorities in those terms will find their conversations move away from justifying individual controls and towards understanding how security choices shape the organisation’s ability to respond to change. In that context, cyber becomes part of how the business navigates uncertainty, rather than a specialist function defending its budget. Speaking the board’s language, ultimately, is less about converting cyber risk into pounds and pence. It is more about understanding which levers matter at that level and showing how security choices influence them.

Learn more at thrivenextgen.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy

Author

Ben Francis

Published

9 January 2026

Estimated Read time

4Mins

Ben Francis, Insurance Lead at Risk Ledger, on navigating cyber threats by reinforcing security from the inside out

Cyber insurance has evolved from a straightforward risk transfer mechanism into an integral component of enterprise risk strategy. As a result, the conversation has shifted beyond simply securing coverage to embracing three foundational elements: transparency in risk exposure, accountability for security measures, and active collaboration throughout the digital ecosystem.

Rather than asking ‘are you covered?’, the more pertinent question has become ‘can you demonstrate measurable risk reduction?’. Insurers and insureds alike are recognising that what matters now is how well an organisation understands and manages its digital exposure, especially across its extended supply chain. Recent data reveals that 46% of organisations experienced at least two separate supply chain-related cyber incidents in the past year, a clear sign that exposure often lies beyond direct control. 

From Risk Transfer to Risk Visibility 

In recent years, the cyber insurance market has matured significantly. Once viewed as a reactive safety net to cushion the financial impact of attacks, it is now becoming a proactive tool for managing and mitigating risk. This shift is partly driven by insurers, who increasingly expect and work with organisations to demonstrate strong security practices and a nuanced understanding of their threat landscape, including risks deep within their digital supply chains; an area where many businesses still fall short.

At the same time, the industry faces a growing challenge from systemic cyber risk within their portfolios, as many businesses rely on the same cloud providers, payment systems and digital platforms, increasing the chance of a single point of failure. Insurers must gain visibility into how policyholders are connected, not only to suppliers but to each other. Tools and frameworks that map and monitor these interconnections will be essential to avoid underestimating the wider impact of seemingly isolated cyber events.

Mapping Beyond Third Parties

It is no secret that cyber attackers often target the weakest link in a supply chain. These are not always direct suppliers, but fourth, fifth or even sixth-tier vendors that have indirect but critical access to systems and data. Unfortunately, many organisations lack visibility beyond their first tier, creating blind spots that attackers can easily exploit. From an insurance perspective, this presents a clear challenge. If an organisation cannot account for who it is connected to, it cannot adequately quantify its risk and neither can its insurer. Mapping these extended connections is more than just a technical exercise; it means actively practiced risk governance and responsibility. Insurers increasingly want to know how their policyholders are identifying and managing indirect dependencies, particularly in sectors like financial services and retail where disruption can ripple across entire markets.

Collaboration as a Risk Strategy 

One of the more underappreciated aspects of cyber resilience is the role of peer collaboration. Unlike physical incidents, cyber threats rarely exist in isolation. A single compromised vendor can impact multiple organisations simultaneously, a fact that has been highlighted by high-profile supply chain attacks such as SolarWinds and MOVEit. 

As a result, businesses need to think beyond their own perimeters and adopt a more collective mindset. This includes building relationships with industry peers, sharing threat intelligence and participating in sector-wide initiatives aimed at improving visibility and preparedness. 

In highly regulated sectors, such as insurance, this collaboration is increasingly being encouraged by oversight bodies. Frameworks like the Digital Operational Resilience Act (DORA) in the EU and initiatives from the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) in the UK are pushing for more transparency around third-party risk. In this context, openness is no longer optional; it will be a regulatory expectation. 

For insurance providers, greater collaboration between policyholders also means better data on emerging threats and more accurate portfolio management. For businesses, it offers a chance to anticipate vulnerabilities that may not yet have hit their own networks but are affecting others in their industry. 

Proactive Transparency Builds Trust 

Organisations that take a proactive, transparent approach to cyber risk management are more likely to secure cover and potentially favourable terms, not just in terms of premiums, but also in access to additional services such as forensic support, incident response sources and legal counsel. 

Demonstrating a mature cyber posture is not about claiming perfection. No organisation is immune to breaches. What insurers are looking for is evidence of a structured approach: the existence of incident response plans, robust governance, effective supply chain risk management, and above all, an honest view of risk. 

A Shift in Mindset 

Ultimately, our understanding of cyber insurance must keep evolving. It should not be treated as a simple checkbox exercise, but as a collaborative relationship between insurers and the organisations they support – one built on shared insight, clear communication, and a drive for continuous improvement.

The organisations best equipped to navigate today’s threats will be those that prioritise transparency. Not only does it lead to stronger protection, but it also builds a culture of accountability that reinforces security from the inside out.

Learn more at riskledger.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech
  • InsurTech