Abstract

We develop a new cryptographic platform called SCRAM (Secure Cyber Risk Aggregation and Measurement) that allows multiple entities to compute aggregate cyber risk measures without requiring any entity to disclose its own sensitive data on cyber attacks, penetrations, and losses. We present results from two computations using the SCRAM platform: (1) benchmarks of the adoption rates of 171 critical security measures across six large firms; and (2) links between monetary losses from 49 security incidents and the specific subcontrol failures implicated in the incident. These results provide insight into problematic cyber-risk control areas that need additional scrutiny and/or investment, but do so in a completely anonymized and privacy-preserving platform.