Algorithms accurately rate cyber resilience: Marsh McLennan

31 October 2022

A study by Marsh McLennan has found measuring cyber resilience with algorithms is accurate and helps insurers make better informed decisions.

The Marsh McLennan Cyber Risk Analytics Center analysed the BitSight Security Ratings Platform, which applies algorithms to produce daily security ratings ranging from 250 to 900 to help underwriters create cyber insurance policies.

Boston-based BitSight offers a Security Rating and 13 “risk vectors,” measuring how many systems within an organisation’s network are affected by important vulnerabilities and how quickly firms remediate them.

Marsh McLennan analysed its proprietary cybersecurity incidents and claims information and BitSight’s security performance data on 365,000 organisations. Poor performers were found to correlate to cybersecurity incidents.

“We identified a statistically significant correlation between BitSight Security Ratings as well as certain BitSight risk vectors and the likelihood of a cybersecurity incident,” Marsh McLennan MD and Cyber Risk Analytics Center Head Scott Stransky said.

Historically, experts have struggled to establish a data-driven relationship between poor cybersecurity performance and the likelihood of data breach incidents.

Demonstrating how BitSight’s measurements do indeed correlate can assist leaders in insurance and elsewhere to make informed decisions, it says.

The analytics with measured correlation relate to endpoint management and malware detection, vulnerability management, secure communications, and user training and awareness.

The study underscored the importance of an organisation’s patching initiatives, with “patching cadence” as measured by BitSight particularly correlated to the likelihood of experiencing a cybersecurity incident.