Actuarial Cyber Risk Engine

Problem

Cyber risk is hard to quantify and the business value of compliance is fuzzy. Leaders can't answer 'what is our expected annual loss in dollars?' or 'what does raising our FedRAMP 20x score actually buy us?' without a defensible quantitative model.

Solution

A Monte Carlo engine decomposes risk into frequency (a Poisson breach count per industry) and severity (a lognormal breach cost scaled to revenue), applies a sigmoid compliance modifier tied to the FedRAMP 20x score, and runs 10,000 simulated years to produce risk quantiles. A counterfactual path re-runs the same seeded scenario with no compliance program to compute exact savings. It's deployed as a Lambda microservice behind API Gateway with API-key auth.

Impact

• →Quantifies compliance ROI in dollars — models the drop in expected annual loss as the FedRAMP 20x score rises via a sigmoid risk-reduction curve.
• →Runs 10,000 simulated years per company and supports five industry profiles (GovCon, HealthIT, FinTech, SaaS, Manufacturing) with distinct base breach frequencies.
• →Produces reproducible risk curves via seeded numpy RNG, enabling peer-percentile benchmarking across a synthetic 1,000-company portfolio.
• →Demonstrates the full stack in one service — actuarial modeling, AWS infrastructure-as-code, API design, and deployment automation.

Architecture

1. 01Input — a company profile (industry, annual revenue, FedRAMP status/score) enters the model layer.
2. 02Frequency — the base industry breach rate is scaled by the compliance modifier, then a Poisson draw yields breach count per simulated year.
3. 03Severity — a lognormal cost is drawn per breach, floored and scaled to revenue, and aggregated per year with vectorized numpy.
4. 04Metrics — across 10,000 trials the engine computes Expected Loss (mean), VaR-95 (95th percentile), and TVaR-95 (tail conditional expectation).
5. 05Counterfactual — the same seeded run repeats with the compliance modifier disabled; savings = mean(no-program) - mean(actual).
6. 06Deployment — AWS CDK provisions the Lambda, S3 corpus bucket, and API-key secret; the handler caches the secret across warm invocations.

Capabilities

• ·Score a single company: input industry, revenue, and FedRAMP status/score; get Expected Loss, VaR-95, TVaR-95, and compliance savings.
• ·Generate a deterministic synthetic portfolio of 1,000 companies (lognormal revenue, realistic FedRAMP spread) for benchmarking.
• ·Apply a sigmoid FedRAMP 20x compliance modifier (0-100 score) plus static discounts for non-continuous authorization statuses.
• ·Run a counterfactual 'no compliance program' simulation on the same seed to isolate the dollar impact of compliance.
• ·Serve results via a Lambda + API Gateway REST endpoint with x-api-key auth backed by Secrets Manager.
• ·Persist corpora to Parquet locally or in S3 for reproducible benchmarking workflows.