Cyber claim counts are falling while the cost of each claim climbs, and across a portfolio the term that is getting worse is set by the growth plan rather than by the security programme.
Two numbers moving in opposite directions
The Chubb 2026 Cyber Claims Report, covered by Infosecurity Magazine on 26 August 2026, is worth an operating partner’s attention less for the headline than for the shape of it. Chubb recorded a significant drop in the volume of cyber claims. Over the same period, 2025 against 2024, the average cost of a claim rose 100% for large US companies and 22% for US middle market firms. In the UK and Europe, average cost per claim rose 98% at large firms and severity rose 34% in the middle market. Small and medium enterprises split by geography: the US average fell from $215,297 to $141,931, while the UK and Europe average rose from $51,095 to $82,621.
Two numbers moving in opposite directions is the part that matters. Fewer events, more expensive events. A portfolio reporting pack built on event counts would have shown an improving year.
Controls move one term, the business moves the other
Quantitative risk practice splits expected loss into two terms: how often a loss event happens, and how much it costs when it does. Frequency responds to controls. Patching, identity hygiene, segmentation, monitoring and response readiness all push down how often an event becomes a loss, and good response work trims the cost of handling one.
Magnitude behaves differently. It divides into primary loss, mainly business interruption, response and replacement cost, and secondary loss, mainly litigation, fines, judgments and reputation. Chubb attributes the US severity increases to the rising cost of data breach and privacy related litigation together with rising business interruption expense. Both of those scale with things a security programme does not set: how many people can be notified, how much data sits in one place, and how much revenue stops per day when a system stops.
Chubb’s illustration is blunt. In a suit involving 10,000 claimants, non-refundable administrative fees alone can exceed $10m before the merits of the case are heard. The claimant count did the work there, not the control gap.
The magnitude term is written into the investment thesis
This is where a portfolio differs from a single company. The steps that create value in a holding are very often the same steps that enlarge the magnitude term.
A roll-up merges three customer databases that used to fail separately. A shared services model puts finance, support and identity administration into one operating layer. A platform migration routes more revenue through one production environment. An analytics or pricing initiative concentrates personal data that was previously scattered across business units. Expansion into a regulated market adds a notification regime and a new class of claimants.
None of those is a security failure. Each is a deliberate, usually correct, operating decision. And each multiplies what the next incident costs.
So a holding can close its findings, cut its incident count, raise its control maturity, and still end the hold period carrying more expected loss than it carried at entry, because the thesis worked. Reported as a control score, that reads as progress. Reported as expected loss, it reads as something else, and only one of those two views is usually on the page.
Why the distribution punishes concentration
Aggregated public breach notification data (Have I Been Pwned, US state and federal breach notification records, and SEC cyber disclosures) shows how unevenly this lands. Of roughly 10,340 aggregated records, about 1,161 disclose a record count. Among only those, the median incident exposed roughly 764,000 records while the mean was roughly 15.4 million. Around 87% of incidents sit below the mean. Roughly 17 incidents, about 1.5% of them, account for half of all disclosed records, and the 20 largest account for about 54%.
That is a distribution where the tail carries the outcome. It also means the same control failure produces very different losses depending on what sat behind it. Concentration is the multiplier, and concentration is what integration work creates.
Four questions that make magnitude visible
Seeing this does not need an actuarial model. It needs four questions asked of every holding, on the same basis, at the same time.
Claimant exposure. How many customers, employees, patients, users or counterparties could be notified from the most concentrated system? Which approved initiatives increase that number, and by how much?
Sensitive record concentration. What are the largest datasets by record count, sensitivity and jurisdiction? Which acquisitions or migrations will add to them, and what could be segmented, minimised or deleted before that happens?
Revenue-days at risk. Which single processes stop revenue when they are unavailable, and how much revenue passes through the most concentrated one on a normal operating day? Which initiatives push more through it?
Planned magnitude jumps. The question that changes the meeting is not whether incidents rose this quarter. It is which approved operating change will make the next incident materially larger.
The answers only compare if every holding is measured the same way, which is the argument in Five Companies Are Rated High Risk. Which One Actually Matters?. What this adds is that a consistent basis has to include the magnitude fields, not control scores alone. Getting honest answers is also less a reporting exercise than a working relationship, because the numbers that matter live in the integration plan and the data architecture, and they surface when the monitoring analyst and the holding’s own management are working the same problem rather than exchanging questionnaires.
Comparing holdings when size is the variable
Portfolios contain companies of very different sizes, and the instinct is to normalise that away. It is worth resisting. Size is part of the risk here, not noise to be divided out.
A large holding with strong controls can deserve more attention than a smaller one with weaker hygiene, because its magnitude term is larger by a margin that no control improvement will offset. A small holding with visible security debt may still carry modest expected loss if its claimant exposure, data concentration and revenue-days at risk are all small. Ranking by incident count, or by control score, would order those two the wrong way round.
The comparison that holds across unequal companies is how much expected loss the next practical intervention would remove. For a software holding approaching a new analytics layer, that may be customer data segmentation before rollout. For a services platform, it may be limiting how acquired records are pooled. For an industrial business, it may be separating production environments before remote access is centralised. Same question, different answers, one basis.
Where in the hold period to intervene
At entry, baseline the magnitude profile alongside the control gaps: largest exposed populations, largest sensitive datasets, most concentrated revenue processes, and the systems that join them.
Before integration, challenge the data and dependency decisions while they are still decisions. Whether every customer record has to merge now. Whether acquired datasets can stay segmented. Whether identity and billing can be connected without creating one broad failure domain.
Before a scale initiative, test revenue concentration. If more of the business is about to flow through one portal or one fulfilment system, the interruption exposure changes on the day that goes live, and it belongs in the value creation plan rather than in the recovery timeline.
Before exit, tell both halves of the story. Fewer weak controls where that is true, and any larger claimant, record or revenue exposure created by successful execution. A buyer’s diligence will find the second half.
The change to portfolio reporting is small. Keep the security metrics, then add one magnitude page per holding using the same fields across the portfolio: current exposure, the next planned step that changes it, and the intervention available before that step goes live. It moves the standing question from how many events happened last quarter to where the plan is making the next one bigger.