Cyber security incidents are costly. Quantifying cyber risk is problematic because it requires deep understand of technology, asset and knowledge of business functions. Data on actual losses is not available, and public information is only partial data. Many top companies have leverage our cyber risk models to quantify their risk. This session will show attendees on a high level, how we quantify cyber risk & what to look out for. Some of the components of that cost such as ransom payment and business interruptions are making headlines. This presentation identifies and describes other costs that may be less well-known but may be equally, if not more important, and explains how to model these costs.