The Illusion of Insured Risk: Why Claims Data is a Dangerous Compass for Cyber Risk Quantification

The Nisura Team ·

When a Chief Information Security Officer (CISO) steps into the boardroom, the Board of Directors rarely asks about zero-day exploits or patch cadences. They ask one fundamental question: “What is our financial exposure, and are we legally compliant?”

To answer this, the industry has turned to Cyber Risk Quantification (CRQ). But a dangerous trend has emerged. Many of the market’s leading CRQ platforms — often built or backed by massive reinsurance conglomerates — calculate your financial risk using historical cyber insurance claims data. On the surface, using a database of millions of historical insurance payouts seems logical. In reality, it provides a mathematically flawed, artificially capped view of your true exposure.

Relying on insurance claims to measure cyber risk is like measuring the size of an iceberg by only looking at the ice above the waterline. Here is why claims-based risk quantification creates a dangerous blind spot for the modern enterprise, and why live telemetry is the only path forward.

1. The Policy Limit Ceiling

Insurance claims data does not represent the total cost of a cyber incident; it only represents what the insurance company was contractually obligated to pay. When a CRQ model uses claims data to project your risk, it bakes in the artificial ceilings of historical insurance policy limits.

If a mid-market manufacturing firm suffers a ransomware attack that costs them €15 million in operational downtime and forensics, but their cyber policy limit was capped at €5 million, the “claim” recorded in the database is €5 million. The remaining €10 million financial crater absorbed by the business is entirely invisible to the algorithm.

2. The Uninsurable “Long Tail” of Cyber Breaches

Cyber insurance is designed to cover direct, immediate costs: incident response, forensics, ransom payments, and legal fees. It is fundamentally incapable of compensating a company for long-term business damage.

According to the IBM Cost of a Data Breach Report 2025, “lost business costs” — which include customer churn, reputational damage, operational downtime, and the loss of future contracts — remain one of the most massive and devastating financial components of a breach. Furthermore, intellectual property theft is notoriously difficult to quantify and is frequently excluded from standard cyber policies.

Even leaders within the insurance industry acknowledge these limitations. Mario Greco, CEO of Zurich Insurance, famously warned the Financial Times that cyber attacks will increasingly become “uninsurable” due to their systemic nature and catastrophic long-tail impacts on civil infrastructure. If massive portions of cyber risk are deemed uninsurable by the underwriters themselves, an algorithm based entirely on their payout data is fundamentally incomplete.

3. The Deductible Blind Spot

Insurance claims data is inherently biased toward catastrophic, high-impact events. It completely ignores high-frequency, lower-impact security incidents. Every cyber insurance policy has a deductible (often called a Self-Insured Retention).

If an enterprise has a €500,000 deductible and a localized breach costs €400,000 to remediate, no claim is ever filed. To a claims-based CRQ platform, that incident never happened. This skews the risk modeling, lulling boards into a false sense of security regarding the localized, everyday threats that slowly drain IT budgets.

4. Backward-Looking Data in a Forward-Looking Threat Landscape

Using historical claims means you are quantifying tomorrow’s threat using yesterday’s data. A payout database from 2021 cannot accurately model the financial exposure of an AI-driven automated supply-chain attack today.

Furthermore, strict new regulations like the EU’s NIS2 Directive (specifically Article 21) legally mandate that companies continuously assess the security of their live supply chains. Regulators do not care what happened to a similar company five years ago; they demand objective evidence of your security posture today.

The Nisura approach: true financial exposure

At Nisura, we believe that to understand your cyber risk, you must measure your actual digital footprint, not an insurer’s balance sheet.

Instead of relying on backward-looking claims data, Nisura uses an active telemetry engine to continuously map your external, internet-facing assets. We cross-reference live vulnerabilities against active exploit databases to calculate your Expected Annual Loss. By calculating risk based on live infrastructure rather than capped insurance payouts, Nisura provides the board with an uncapped, defensible financial metric. More importantly, it instantly translates that telemetry into the automated supply-chain evidence packs required by NIS2. Put a euro figure on your own exposure with the free CRQ simulation.

Stop guessing your cyber risk based on what an insurance company paid out to someone else. It is time to see your true financial exposure.

Sources & further reading

Frequently asked questions

Why is claims-based cyber risk quantification flawed?

It caps risk at historical insurance policy limits, ignores uninsurable long-tail losses like customer churn and IP theft, misses incidents below the deductible, and uses backward-looking data to model forward-looking threats.

Does cyber insurance cover the full cost of a breach?

No. Cyber insurance covers direct costs such as incident response, forensics, ransom and legal fees, but typically excludes long-term business damage, reputational loss and much intellectual-property theft.

What is a better alternative to claims data for measuring cyber risk?

A passive telemetry engine that continuously maps your external, internet-facing assets and cross-references live vulnerabilities against active-exploit databases to calculate an uncapped Expected Annual Loss.