Dollars, Days and Odds: How to Build a Cyber Risk Appetite Your Board Actually Uses
Join me on Tuesday, November 10, 2026 at 1:20 pm ET at FAIR Forward for a brilliant practitioner session: "Dollars, Days and Odds: How to Define and Operationalize a Quantitative Cyber Risk Appetite."
Here is the moment that started it all. Mohammad Arif, Head of Information Security at Guild Insurance in Australia, had done the hard work. His team had quantified their top cyber risks with FAIR. The numbers were on the table in front of the board. And then the board asked the question that every one of us eventually hears: "Great. So what do we do about it?"
The FAIR analysis alone couldn't answer that. So Arif built something most of us only talk about: a quantified cyber risk appetite that his board actually uses to make decisions. In our conversation, he walks through exactly how he did it, warts and all. No theory for the sake of theory, just a practitioner telling us how it really went.
If I had to sum up the session in one line, it would be this: quantification measures the risk; appetite determines the decision. Many of you already have the first half. This session is about the second.
A color tells you how to feel. A boundary tells you what to do.
Arif's first move was to retire the heat map as a decision tool. Show two executives the same amber cell, and one will accept it while the other wants it fixed. Over time, those quiet acceptances add up to something big. His fix: replace colors with explicit boundaries that tell the business what to do.
And those boundaries have three dimensions, not one:
- Dollars. How much could we lose? Arif anchors losses to the numbers the CFO already lives by: gross written premium, insurance revenue, underwriting margin and capital surplus. The twist is that the most restrictive anchor applies. In his illustrative example, a loss that looks like a rounding error against premium wipes out nearly a quarter of a year's underwriting margin. Nobody gets to pick the comparison that makes the number look comfortable.
- Odds. How likely is it? Instead of showing board members loss exceedance curves, Arif asked them a plain question: are you comfortable with this happening once every two years, once every five, or once every ten? Come hear why he believes probability is the early-warning signal that dollars alone will miss.
- Days. How long can we be down? Arif didn't invent a cyber outage limit. He borrowed the maximum outage tolerances the business had already set for its critical operations.
The rule that ties it together: a scenario is out of tolerance if any one dimension is breached. Green dollars cannot offset red days. Tune in to see how he applies all three to a real-world ransomware scenario.
The hard part isn't the math
When I asked Arif who set the thresholds, his answer was immediate: not him. Security designed and proposed the model. Finance owned the financial measures, the business owned the outage limits, and the board approved the appetite. As he puts it, the quickest way to lose credibility is to set the numbers yourself.
A few more things you'll hear in the full conversation:
- How four layers (board, executives, risk owners and control owners) each watch the part of the model that matters to them, so the board never needs a 200-metric dashboard.
- Why an auditor from the agency that rates insurance companies told him they had never seen this done before.
- Why he believes most organizations that fail at this don't have a modeling problem. They have a governance problem.
- The biggest myth about quantified risk appetite, and what he would do differently if he started again tomorrow.
And stay until the end for his one practical step you can take next week, even if your board isn't asking for any of this yet. It's simpler than you think.
Also at FAIR Forward on November 10
Arif's session is one of five, and together they give you the full picture in a single afternoon: what is the Institute’s strategy moving forward, where our profession stands today, how CISOs are tackling AI risk, how one practitioner turned quantification into board decisions, and what boards should really be asking.
- FAIR Institute 2.0: Independent, Member-Governed, and Built for the Age of AI Risk (10:00 – 11:00 AM ET, live). Jack Jones and I unveil the Institute's strategy for the future and how it will set the standard for cyber, AI and technology risk, followed by a live Q&A.
- Closing the Gaps (11:10 AM – 12:00 PM ET). The results of our annual 2026 State of Cyber Risk Management Report: how organizations measure, manage and report cyber risk today, where they fall short, and practical steps to close the gaps. With Todd Tucker (FAIR Institute), Michelle Griffith (TransUnion) and Will Klotz (GuidePoint Security).
- Managing Cyber Risk in the Age of AI (12:30 – 1:20 PM ET). A CISO panel moderated by Robert Rodriguez (SINET), with MJ Gautam (Instacart), Esmond Kane (Advarra), Jerry Archer (Cloud Security Alliance) and Gaurav Gupta (Santander) on how they identify, measure and govern AI-related risk, and explain it to their boards.
- Your Board Is Asking the Wrong Cyber Questions (2:15 – 3:00 PM ET). A board panel I'll moderate on what the 2026 NACD-ISA Director's Handbook on Cyber-Risk Oversight says directors should ask instead, with Larry Clinton (ISA), Tracie Grella (AIG), Dylan Sandlin (NACD) and Kristin Lovejoy (Kyndryl; Dominion Energy board).
A practitioner case study, a CISO panel, a board panel and fresh industry data: everything you need to move cyber risk management forward.
I hope to see you there.
