Blog Post
A One-in-Hundred-Year Cyber Loss Is Not a Schedule
October 6, 2026
A quantification exercise reports a one-in-hundred-year loss and the figure travels well. It sounds precise, it sounds severe, and everybody in the room believes they understand it.
Most of them do not. The phrasing describes an annual probability and it reads as a statement about timing, and the two produce different decisions from the same number.
What Does the Figure Mean?
A one percent chance in any given year, which is a statement about likelihood rather than schedule.
The convention comes from hydrology, where the recurrence interval convention has been used for decades to describe flood magnitudes. A one-in-hundred-year flood is one with a one percent probability of being equalled or exceeded in any single year. It is not a prediction that one arrives every hundred years, and two can occur in consecutive years without the figure being wrong.
Which Is Exactly the Misreading
Heard as timing, the figure implies an event is due, or overdue, or recently used up. None of those follow. Each year draws independently, so an organization that suffered a severe loss last year faces the same one percent this year as one that has never had an incident.
What Decision Does the Misreading Produce?
Deferral, usually, and it is the specific consequence worth naming.
A board that hears a hundred-year event as a distant one reasons that the investment can wait. A board that hears a one percent annual chance reasons about it the way it reasons about any other one percent annual chance, which is the comparison the figure exists to enable.
The Compounding Is the Part That Lands
One percent a year over a five-year planning horizon is close to a five percent chance across the horizon, and over the ten-year life of an investment decision it is close to ten. Stated that way the number stops sounding remote, and the arithmetic is simple enough to do in the room.
What Should Be Said Instead?
The probability rather than the interval, in the same sentence as the figure.
A loss of this size has a one percent chance of being reached or exceeded in any year is longer than a one-in-hundred-year loss and it cannot be misheard. Where the audience is used to the interval convention, both can be given, with the probability first because it is the operative fact.
Which Convention Should a Report Use?
Whichever the audience already uses, stated once with its meaning attached. An insurance audience reads return periods fluently and a board committee frequently does not, and the same numbers for two audiences covers why one report rarely serves both.
Why Does the Convention Persist?
Because it is genuinely useful to the people who built it, which is worth acknowledging rather than treating the phrasing as a mistake.
Return periods let very different magnitudes be compared on one scale, and they map onto capital and reinsurance structures that are built around specific exceedance levels. Inside those disciplines the phrasing is precise and nobody misreads it. The trouble arrives when the figure leaves them.
Which Makes This a Translation Problem
Not a modeling problem. The number is correct and the wording travels badly, so the fix is in the reporting layer rather than in the method, and reporting a quantified figure upward is where the translation belongs.
What Is the Second Misreading?
Treating the figure as a maximum, which is less discussed and equally consequential.
A one-in-hundred-year loss is a level with a one percent chance of being exceeded. Exceeded, not reached. So there is a one-in-two-hundred figure above it and a one-in-thousand above that, and an organization sizing a limit against the one percent level has covered the one percent case and nothing more severe.
What Should Accompany It?
At least one more severe point, so the shape above the reported level is visible. A figure quoted alone invites the assumption that it is the ceiling, and the exceedance curve exists precisely because a single point does not describe a tail.
Does the Figure Assume the Environment Holds Still?
It does, and that assumption is the one an audience is entitled to question.
An annual probability derived from a model reflects the environment as modeled. Where the estate changed, controls were added or a business was acquired, last year's one percent describes last year. The hydrological convention has the same limitation, since a changing catchment alters the flood probability without the label changing.
Which Argues for Dating the Figure
A one percent annual chance as assessed on a stated date is honest, and the same figure quoted a year later without a date is not, which why an assessment expires covers for the underlying position.
Does the Same Confusion Affect the Average?
Differently, and the average carries its own misreading that gets less attention.
An average annual loss is frequently heard as a budget, meaning the amount to set aside each year. For a distribution with a long tail the average sits above most years and below the bad ones, so most years cost less than the average and the occasional year costs vastly more. Setting aside the average annually is neither the typical experience nor adequate provision.
What Does the Average Support?
Comparison rather than provisioning. It is the right figure for ranking scenarios against each other and for weighing a control investment against the exposure it removes, because both are comparisons at the same statistic. Provisioning needs a percentile.
Which Two Figures Should Travel Together?
The average and one tail point, labeled with what each supports. An average alone invites the budget misreading and a tail point alone invites the ceiling misreading, and reporting both with a line on their use costs a sentence, which the average annual loss figure is routinely quoted without.
What Should Be Established?
Three things, and none of them changes the model.
Whether the audience for each report reads return periods fluently, since the answer determines the phrasing. Whether the reported figure is accompanied by at least one more severe point, so it is not read as a ceiling. Then whether every quoted figure carries the date of the assessment it came from. Cyber risk quantification that reports a curve rather than a number removes most of the ambiguity before the translation question arises.
An Annual Probability, Not a Schedule
The convention comes from hydrology, where a one-in-hundred-year event means a one percent chance of being equalled or exceeded in any single year, and two can occur in consecutive years without the figure being wrong. Heard as timing it implies an event is distant or recently used up, and neither follows, since each year draws independently. The consequence is deferral, because a distant event can wait while a one percent annual chance gets compared against other one percent chances. Stating the probability rather than the interval fixes it, and compounding across a planning horizon is what makes the number land. The second misreading is treating the level as a maximum when it is a level with a one percent chance of being exceeded. Kovrr's cyber risk quantification reports the curve rather than a single point.
To see exposure reported as a curve rather than a single return period, book a demo with our risk experts.
Return Period FAQs
Speak to an ExpertWhat does a one-in-hundred-year loss mean?
Why is the return period framing misleading to a board?
How should a one percent annual loss be presented instead?
Is a one-in-hundred-year loss the maximum possible loss?
Why does the return period convention persist if it is misread?
Does a one percent annual probability assume the environment stays the same?
