Every component of the world’s public and private infrastructure is subject to the risk of a cyber attack. Companies today face loss of or damage to digital assets; theft of funds; security and privacy breaches and associated liabilities; and nonphysical business interruption. For companies that offer cyber insurance, managing the risk is a complex undertaking. One primary challenge is the sparsity of historical loss data that can be used to estimate the frequency and severity of potential attacks. Furthermore, risk managers need to account for scenarios that are unprecedented in their severity—or the cyber equivalent of Hurricane Andrew, an event that incurred insured losses that were unimaginable to most insurers before the storm struck in 1992.