Cyber risk · RiskAtoms Academy

By the end you will be able to

1Describe the main cyber threats to a bank (ransomware, data breach, denial of service, business email compromise) and where their losses land among the Basel event types.
2Map the controls that prevent, detect and recover from them, and read a bank's cyber RCSA and KRIs.
3Quantify cyber losses as frequency times severity and compute an expected annual loss.
4Explain how a cyber insurance layer (retention, limit, loading) changes the expected cost and the losses a bank keeps.

Why it matters

On 2 April 2025 criminals who had phished the mailboxes of RiskAtoms Bank's relationship managers redirected client payments. The bank found out a week later and reimbursed its clients: £6.2m gross, £5.1m after £1.1m was recalled. That one fraud is 60% of everything the bank has lost to cyber events in ten years. And the warning was there: the phishing test click rate had been red since January, peaking at 10.3% of staff tested.

Core explanation

Threats, controls and the cost of being wrong

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, reporting at 31 December 2025: ten years of internal loss events above £10,000 (2016 to 2025), an RCSA, ten key risk indicators, seven workshop scenarios, five important business services and five suppliers. Every event, person, supplier and figure is made up for teaching and seeded so it never changes; none is any bank's data. Every lesson in Module 3.7 uses this book, so the figures agree.

The book records cyber as one of the bank's own risk categories: 91 losses, a net £8.54m over 2016–2025, about £0.85m a year. It also carries two cyber scenarios: ransomware takes core banking down (S1) and a customer data breach with a fine (S6).

Cyber risk has no box of its own in the Basel grid (L2.2.05: Operational risk). It is a cause, and its losses are filed by what they did. That is why banks track it as a category of their own across the event types, as RiskAtoms Bank does. Four threats account for most of the losses:

Ransomware: systems encrypted, operations stopped, often with data stolen first. The cost is the outage, the rebuild and the customer harm, whether or not a ransom is paid.
Data breach: customer data taken. The cost is notification, compensation, remediation and fines, often years later.
Denial of service: services flooded until customers cannot reach them. Usually short and cheap to absorb, occasionally not.
Business email compromise: money paid to criminals by people who think they are following a genuine instruction. The FBI's Internet Crime Complaint Center recorded close to $2.8bn of such losses reported to it in 2024 alone.

Sort itWhere does the loss go?

Each cyber incident at RiskAtoms Bank. Under which Basel event type is the loss reported?

Criminals take over customers' online banking with stolen passwords and move £300,000 out. The bank refunds them.
A denial-of-service attack takes the website down for six hours; the bank pays for emergency mitigation.
A database of customer records is stolen. The bank pays compensation and the regulator fines it.
An IT administrator sells customer data to a criminal gang.
Phished mailboxes redirect client payments; the bank reimburses its clients (April 2025).

Controls: govern, identify, protect, detect, respond, recover

The US NIST Cybersecurity Framework, revised as version 2.0 in February 2024, groups cyber controls under six functions: the original five plus Govern, added in 2.0. Laying controls against them is a quick way to look for gaps. Click through RiskAtoms Bank's controls against each.

ExploreRiskAtoms Bank's cyber controls by function

Click a function to see the bank's controls and their last test.

Govern

The Chief Information Security Officer owns ransomware and phishing risks; the Data Protection Officer owns the breach risk. Their KRIs (patching, phishing clicks) report monthly to the operational risk committee (L3.7.05: Key risk indicators in practice).

Key risk	Inherent	Residual	Rating after controls
R01 Ransomware or destructive cyber attack	15	10	High
R02 Phishing leads to account compromise and payment fraud	12	9	Medium
R12 Customer data breach	12	12	High

Under the book's residual rule, only controls that work in both design and operation reduce a rating (L3.7.04: Controls: design, testing and assurance). Ransomware stays High because patching failed and the restore test was only partly effective; the data breach stays High because its only control is partly effective. Of the 6 cyber controls, 2 work fully.

Quantifying cyber losses

Illustrative dataLesson extraThe lesson's cyber loss model

Four threats, each with how many incidents a year get past the first defences (λ) and three outcomes with probabilities. It is a simpler, discrete cousin of the book's scenarios: the worst ransomware outcome matches S1's £200m severe case and the mass breach is once in 20 years, as in S6. Made up for teaching.

Threat	Incidents a year	Outcomes if it happens	Mean loss	Expected a year
Ransomware	0.25	£0.50m (70%), £25m (25%), £200m (5%)	£16.600m	£4.150m
Data breach	0.50	£0.20m (75%), £5m (15%), £40m (10%)	£4.900m	£2.450m
Denial of service (DDoS)	2.00	£0.05m (90%), £0.50m (9%), £5m (1%)	£0.140m	£0.280m
Business email compromise	3.00	£0.05m (85%), £1m (13%), £6m (2%)	£0.292m	£0.877m
All four				£7.76m

Expected loss is frequency times mean severity (L3.7.07: Measuring frequency and severity), and the mean is a probability-weighted sum (M-C02: Expectation). The model expects £7.76m a year, nine times the bank's history. Most of it comes from outcomes nobody at the bank has seen: the 5% chance that ransomware reaches the backups contributes £2.50m a year on its own. Denial of service happens most often and matters least.

Cyber in the bank's numbers

The book's scenarios put ransomware at £2.49m and a data breach at £0.91m of expected loss a year. Real costs are of this order: IBM's Cost of a Data Breach Report 2025, based on breaches studied by the Ponemon Institute between March 2024 and February 2025, put the global average cost of a breach at $4.44m and the US average at $10.22m.

The formal version

Each threat is a Poisson number of incidents a year with mean λ, and each incident ends in one of a few outcomes $x_k$ with probabilities $p_k$ . Expectations are sums (M-C02: Expectation):

\begin{aligned} E[X] &= \sum_k p_k\, x_k, \qquad \textstyle\sum_k p_k = 1 \\ \text{EAL} &= \lambda\, E[X] \qquad \text{(frequency times mean severity, L3.7.07)} \\ \text{EAL}_{\text{all}} &= \sum_{\text{threats}} \lambda_j\, E[X_j] \end{aligned}

An insurance layer. With a retention $R$ and a limit $L$ per event, the insurer pays the part of each loss between $R$ and $R + L$ , the layer:

\begin{aligned} \text{pay}(x) &= \min\big(\max(x - R,\, 0),\, L\big) \\ \text{kept}(x) &= x - \text{pay}(x) = \min(x, R) + \max(x - R - L,\, 0) \\ E[\text{payout a year}] &= \lambda \sum_k p_k\, \text{pay}(x_k) \\ \text{premium} &= (1 + \theta)\, E[\text{payout a year}] \end{aligned}

Here $\theta$ is the insurer's loading. Because $\theta > 0$ , insurance always raises the expected cost: the bank pays $\theta\,E[\text{payout}]$ a year on average. What it buys is a smaller worst case. Expectation alone cannot justify insurance; the tail can.

Try it

Start with a £5m retention and a £50m limit. Raise the limit to £200m and see the premium climb while the worst ransomware outcome shrinks. Raise the retention and the premium falls, but every serious incident costs more. Then cover business email compromise and see how little it adds.

Try itDesign a cyber insurance layer

Retention per event£5m

Limit per event£50m

Insurer's loading60%

Business email compromise

Kept by the bank (retention)Paid by the insurerAbove the limit (kept)

Each bar is one serious or severe outcome, with its probability if an incident of that kind happens.

Expected annual loss, no insurance£7.76m

Expected cost with insurance£9.93m

Insurer's expected payout a year£3.63m

Premium (payout × (1 + loading))£5.80m

Expected losses the bank keeps£4.13m

Net cost of the cover£2.18m

Kept if backups are encrypted (£200m)£150m

Kept if a million customers' data is stolen (£40m)£5m

Per-event cover only: no annual aggregate limit, no waiting period, no sub-limits. The premium is the expected payout plus a loading for the insurer's costs, capital and profit. Illustrative model, £ millions.

Worked example

Ransomware, with and without the layer

From the lesson's model: 0.25 ransomware incidents a year get past the first defences. The layer has a £5m retention, a £50m limit and a 60% loading. £ millions.

Expected loss, expected payout, premium

Step 1 of 5

1
Mean loss if it happens
$E[X] = 0.70 \times 0.5 + 0.25 \times 25.0 + 0.05 \times 200.0 = \text{£}16.60\text{m}$

Regulatory lens

The Basel Committee's 2021 Principles for the Sound Management of Operational Risk ask banks for a robust programme for information and communication technology risk (Principle 10), including cyber security, aligned with their operational risk framework. In the UK, a cyber attack is an obvious severe but plausible scenario to test important business services against (L3.7.15: Operational resilience), and a data breach also brings data protection law and its fines (L3.7.13: Legal, compliance and regulatory risk). Insurers have narrowed what they will cover: since 31 March 2023, Lloyd's has required standalone cyber-attack policies written in its market to exclude losses from state-backed cyber attacks, because such losses could exceed what the market can absorb. Under the standardised approach, cyber losses enter capital only through the loss component (L3.7.07: Measuring frequency and severity); M4.4: Counterparty, operational and large exposures covers the rules.

Spark Atoms

Spark AtomThe 30-hour restore

On 30 September 2025, a test restore of the payments database took 30 hours against a 12-hour target. Two weeks later, on 14 October, a failed upgrade took the same platform down for 31 hours (L3.7.09: Technology and change risk). A backup test is a measurement of how long a ransomware outage would last, and this one was read as a finding to fix by mid-2026 rather than as a warning.

Spark AtomInsurance is not a control

The UK National Cyber Security Centre's guidance on cyber insurance says that a policy will not prevent a breach or attack. It also warns that some policies exclude business email compromise, the fraud that cost RiskAtoms Bank £5.1m in 2025.

Key takeaways

Cyber is a cause, not a Basel event type: stolen funds are external fraud, outages business disruption, data losses clients and products.
RiskAtoms Bank's cyber history is small (£8.54m in ten years) and dominated by one email compromise, which a red phishing KRI led by 61 days.
Controls span the six NIST CSF 2.0 functions (govern, identify, protect, detect, respond and recover); ransomware and data breach stay High because patching, restores and data loss prevention do not fully work.
Expected annual loss is λ × Σ p·x per threat, summed over threats: £7.76m in the lesson's model, mostly from rare severe outcomes the data has never seen.
An insurance layer pays min(max(x − R, 0), L); the premium exceeds the expected payout, so cover raises the expected cost (£2.18m a year here) and buys a smaller worst case.

Reaction

Check what stuck

Question 1 · objective 3

A threat gets through twice a year. Each time, the loss is £0.1m with probability 0.9 and £2m with probability 0.1. What is the expected annual loss, in £m?

£m

Question 2 · objective 4

A cyber policy has a £5m retention and a £50m limit per event. Ransomware costs the bank £25m. How much does the insurer pay, in £m?

£m

Question 3 · objective 1

Ransomware shuts the bank's payments platform for two days. No money is stolen, but customers are compensated and the systems rebuilt. Under which Basel event type is the loss reported?

ABusiness disruption and system failuresBExternal fraudCClients, products and business practicesDThere is a separate cyber event type

Question 4 · objective 4

In the lesson's cyber model, the default layer is expected to pay £3.625m a year. With a 60% loading, what is the premium, in £m?

£m

Question 5 · objective 3

Over ten years the bank's cyber losses averaged £0.85m a year. The lesson's model expects £7.76m. Which explanation is most reasonable?

AThe model includes rare, severe outcomes (an encrypted core system, a mass breach) that ten years of one bank's data has not seenBThe model is wrong because it does not match the dataCThe data should be scaled up by the inflation of the last ten yearsDThe model double counts business email compromise

Glossary

Cyber risk: The risk of loss from attacks on, or failures of the security of, a firm's systems and data. A cause, not a Basel event type: its losses land in external fraud, business disruption or client practices.
Ransomware: Malicious software that encrypts a firm's systems and data and demands payment for the key, often after copying data to threaten its release.
Data breach: Personal or confidential data accessed or stolen by someone not entitled to it.
Denial of service (DDoS): Distributed denial of service: flooding a website or service with traffic from many machines until real users cannot reach it.
Business email compromise: Business email compromise: a criminal takes over or imitates a trusted email account and tricks staff or clients into paying money to the wrong account.
Endpoint detection and response: Endpoint detection and response: software on every server and laptop that spots and isolates malicious behaviour.
Immutable backup: Backups that cannot be changed or deleted for a set period, even by an administrator, so ransomware cannot encrypt them.
Retention (deductible): The part of each loss the insured firm pays itself before the insurer pays anything: the deductible.
Limit: The most the insurer pays for one event (or in a year, for an aggregate limit).
Layer: The band of losses an insurer covers, from the retention up to the retention plus the limit.
Loading: What the premium adds on top of the expected payout: the insurer's expenses, capital cost and profit.

Deep Dives & Origins

Deep Dives

National Cyber Security Centre, Cyber insurance guidance: what cover typically includes and the questions to ask. Introductory.
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021, Principle 10 (ICT risk, including cyber). Intermediate.

Origins

Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021, Principle 10 and paragraphs 61–62.
Hunton Andrews Kurth, “NIST Releases Cybersecurity Framework 2.0”, 4 March 2024 (the six functions).
M. Kapko, “Research shows data breach costs have reached an all-time high”, CyberScoop, 30 July 2025, reporting IBM and the Ponemon Institute, Cost of a Data Breach Report 2025.
Nacha, “FBI's IC3 Finds Almost $8.5 Billion Lost to Business Email Compromise in Last Three Years”, 24 April 2025.
Lloyd's, Market Bulletin Y5381, “State backed cyber-attack exclusions”, 17 August 2022.
National Cyber Security Centre, Cyber insurance guidance, first published 6 August 2020.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.