(TR07)(INCYBER) Quantifier le risque cyber : mieux mesurer pour mieux protéger, gérer et assurer

Value of the Information & Strength of the Argument

The value of the information lies in the practical, real-world perspectives shared by the panelists, who represent both technology vendors and insurance companies. They provide concrete examples of how cyber risk quantification is implemented, such as Qualys’s ROC and AXA’s RQI tool, and discuss the benefits of translating risk into financial terms to engage executives. The argumentation is coherent and grounded in professional experience, but it is largely anecdotal and lacks rigorous scientific evidence. The panelists acknowledge limitations, such as the reliance on expert judgment and the challenges of data scarcity, which adds credibility. However, the discussion is somewhat promotional, with vendors highlighting their solutions, and the scientific depth is moderate.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the panelists reference established methodologies like FAIR and Monte Carlo simulations, but they do not provide detailed citations or empirical data. The sources cited in the description are limited to the INCYBER forum website and LinkedIn, which are not directly related to the technical content. The title accurately reflects the content, which focuses on quantifying cyber risk for protection, management, and insurance. The discussion is well-structured and covers multiple perspectives, but it lacks independent verification and peer-reviewed references.

The title accurately reflects the content, which focuses on quantifying cyber risk for protection, management, and insurance purposes.

7/10

The panel consists of industry experts from Qualys, AXA, and CNP Assurances, providing practical insights and case studies. The discussion is grounded in professional experience and references established methodologies like FAIR and Monte Carlo simulations. However, the content is largely promotional and lacks peer-reviewed sources or independent verification.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction to the roundtable and the topic of quantifying cyber risk.
• 05:00Pierre-Louis Louisan from Qualys explains the concept of a Risk Operations Center (ROC) and the importance of asset inventory and risk prioritization.
• 10:00Louisian discusses how ROC helps reduce investment by focusing on critical assets, citing a case study with a chemical company.
• 15:00Rebia Bardo Girard from AXA describes their approach to quantifying risk for clients, including the RQI tool that generates risk profiles in 15 minutes.
• 20:00Girard emphasizes the importance of translating technical risk into financial terms for CFOs and the four pillars of their strategy.
• 25:00Estelle Boyer Chigic from CNP Assurances introduces the FAIR methodology and the use of Monte Carlo simulations for cyber risk quantification.
• 30:00Boyer Chigic shares their experience implementing FAIR on a restricted perimeter, highlighting key success factors and challenges.
• 35:00Boyer Chigic discusses the benefits of quantification, including engaging business stakeholders and identifying critical impacts.
• 40:00Boyer Chigic mentions limitations such as the lack of historical data and the challenge of obtaining reliable information from business units.
• 45:00The panel concludes with a discussion on the future of cyber risk quantification and the need for continuous improvement.

• INCYBER Forum Europe — Official website of the INCYBER Forum Europe, the event where this roundtable took place.
• INCYBER Europe LinkedIn — LinkedIn page of INCYBER Europe, providing updates and networking opportunities.

• FAIR Institute — The FAIR Institute promotes the FAIR methodology for cyber risk quantification, aligning with the approach discussed in the video.
• NIST Cybersecurity Framework — The NIST framework provides a structured approach to managing cyber risk, complementing the quantification methods discussed.

• Cyber Risk Quantification: A Critical Review — Some academic critiques argue that current quantification methods, including FAIR, rely heavily on subjective inputs and may not accurately capture the complexity of cyber risk.