Extending a Cyber Risk Quantification Program to AI

A company that already quantifies cyber risk is now being asked the same question about AI. The board wants a figure, the audit committee wants it in the same units as everything else, and the person who built the cyber program is the one being asked.

‍

That is a better starting position than it feels like. Most of the apparatus transfers. The parts that do not are specific, and knowing which is which separates extending a program from starting a second one beside it.

‍

What Transfers Without Modification

‍

The structure, which is the part that took longest to build.

‍

A loss model is a statement about how often something happens and what it costs when it does. That holds whether the cause is ransomware or an AI system behaving in a way nobody intended. Cyber risk quantification (CRQ) already expresses exposure as a distribution rather than a rating, produces an annualized expectation and a tail figure, and models controls as adjustments to frequency and severity rather than as a maturity score.

‍

Everything downstream of that transfers too, and it is the half that usually costs the most political effort. A board that reads a loss exceedance curve does not need to be taught again. An appetite statement denominated in currency accommodates a new exposure without being rewritten. The reporting cadence, the committee that receives it and the convention of comparing a mitigation against the loss it removes all carry over unchanged.

‍

Which Is Why the Second Program Should Not Exist

‍

An organization running AI exposure as a separate exercise with its own scoring, its own cadence and its own committee has produced two risk pictures that cannot be added together. The board then asks which number is larger and nobody can answer, because the two were not built to be compared.

‍

What Does Not Transfer

‍

Three things, and each one changes a specific part of the method rather than the whole.

‍

One, There Is No Loss History

‍

Cyber severity distributions rest on decades of claims and reported incidents. AI incidents are few, recent and inconsistently disclosed, so the same fitting cannot be done.

‍

The way through is to notice what an AI failure costs. A model handling regulated data wrongly produces a privacy loss. An agent taking an unauthorized action produces business interruption, contractual exposure or both. A system making a decision it cannot defend produces regulatory penalty and legal cost. Those loss types are the ones a cyber program already models with real data behind them. What changes is the path to the loss, not the loss.

‍

Two, the Inventory Does Not Exist Yet

‍

A cyber quantification starts from a known estate. Somebody can list the systems, the data and the vendors, because those arrived through procurement.

‍

AI did not. It arrived inside software the company already licensed, through a free tier nobody expensed, and through agents built by a team that never filed a ticket. So the first step of an AI extension is discovery rather than modeling, and a figure produced before that discovery is a figure about the AI somebody happened to know about.

‍

Three, the Loss Can Arrive With Nothing Compromised

‍

The deepest of the three. A cyber loss model starts from an event against an asset, meaning something was breached, encrypted or taken offline.

‍

A large share of AI exposure has no such event. A hiring decision that cannot be defended, regulated data submitted into a sanctioned tool by an employee doing their job, an agent committing the company to something it should not have. Nothing was compromised. No control failed in the way a control fails. The liability attaches anyway, which is why the office answering for AI is frequently not the one that introduced it.

‍

A model built only on compromise events will return a low AI figure and will be wrong in a direction nobody notices.

‍

How the Extension Gets Built

‍

Four steps, in an order that matters.

‍

• Discover before modeling: every AI system touching corporate data, including features inside licensed software and agents nobody registered, each with an owner and a record of what it can reach.
• Map AI scenarios onto loss types already modeled: privacy, business interruption, regulatory, contractual and liability, so the severity side rests on data that exists.
• Model the ones with no compromise event: output-driven and authorization-driven losses, which need their own scenarios rather than an adjustment to existing ones.
• Report both in one view: the AI figure and the cyber figure in the same units on the same cadence, so the board compares them rather than receiving them separately.

‍

AI risk quantification (AIRQ) runs the same simulation structure over AI systems, agents and vendors, producing an annualized loss expectancy, loss exceedance curves and inherent against residual exposure. It sits inside the AI Security and Governance Platform alongside the discovery and inventory the first step requires.

‍

What the Extension Changes for the Board

‍

The question it can ask, which moves from whether AI is being governed to what AI is worth as an exposure.

‍

A maturity score answers the first and cannot answer the second. Directors receiving a framework assessment know whether a process exists. They cannot weigh it against the cyber figure in front of it, against the cost of the control being proposed, or against the appetite threshold they approved last year.

‍

And What It Changes for the Person Reporting

‍

The argument they can make. A security leader asking for AI governance budget against a maturity score is asking for trust. The same leader showing exposure before and after a control, in the currency the cyber program already reports in, is making the case the organization taught itself to evaluate years ago.

‍

One Method, Two Exposures

‍

A cyber risk quantification program is most of an AI risk quantification program already. The frequency and severity structure transfers, the simulation transfers, and the board literacy, the appetite statement and the reporting cadence transfer with them, which is the expensive half. Three things do not. There is no AI loss history to fit against, so severity has to rest on the loss types a cyber program already models. The AI inventory does not exist yet, so discovery comes before modeling rather than after. And a large share of AI loss arrives with nothing compromised, so output-driven and authorization-driven scenarios need modeling in their own right. Build those three and the AI figure sits beside the cyber figure in the same units, which is what lets anyone decide between them.

‍

To see AI exposure modeled in the same terms as cyber exposure, book a demo with our risk experts.