Estimated reading time: 7 minutes
Three years ago, the board meeting was where cyber risk lost its meaning. Security leaders showed up with red, amber, and green charts. CFOs nodded along. Nobody could say what any of it meant in dollars. That gap is the one Resilience built Edge to close, and the wider market has been moving the same direction ever since. On the platform’s third anniversary, the company says the bet paid off.
Edge clients reduced modeled extreme cyber loss exposure by more than $1 billion between 2023 and April 2026, Resilience announced June 10. The client base behind that number grew more than tenfold over the same period. CEO Vishaal Hariprasad framed the figure as proof of concept, not marketing. “Reducing extreme loss exposure by one billion dollars is not a product metric,” he said. He called it evidence that security teams act when they have financially grounded data.
“That is what Edge was built to produce, and that is what three years of client outcomes shows,” said Hariprasad.
The number is real, and Resilience is clear about what it does and does not represent. That candor is worth crediting up front, because it also tells a CFO exactly how to read the headline.
What The Billion Dollars Actually Measures
Veda Kumarjigud, Resilience’s director of product marketing, walked Cyber Insurance News through the mechanics. Extreme loss sits at the high end of a client’s Loss Exceedance Curve. That is the rare, severe tail outcome that matters most for solvency planning, not a routine claim. The billion-dollar figure aggregates the change in that modeled exposure across every Edge client. Resilience calculates it as the gap between each client’s exposure before and after the controls in their Cyber Action Plan, the tool that ranks fixes by the dollars of exposure each one removes.
That distinction is the whole story. “It reflects modeled exposure reduction tied to documented control changes – not avoided claims or realized losses,” Kumarjigud said. It is not a measurement of what happened to any client’s balance sheet. It is a measurement of what Resilience’s model now predicts, set against what the same model predicted before.
Kumarjigud was direct about the source of the number. It comes from the company’s internal risk quantification models, not from tracking what clients actually paid out or avoided. A reader translating the headline into a balance-sheet impact should keep that distinction in view, and Resilience does not obscure it. The company has made similar exposure-reduction claims before, tied to specific control partnerships.
Kumarjigud said Resilience validates the model separately, testing its predictions against actual claim outcomes across its book of business. That is the right validation to run. It is also a claim about process, not a published result. Resilience did not offer a backtesting accuracy figure, a sample size, or any third-party actuarial review when asked how the model performs against reality. For an audience of underwriters and actuaries who build careers on that kind of disclosure, the gap is worth watching for in future Resilience materials.
Quantification And Underwriting Are Connected, Not The Same Thing
The natural follow-up for any CFO is whether better numbers buy better terms. Resilience’s answer rewards close reading, and it is a careful one.
Kumarjigud said the company starts with quantification, then ties it to specific actions that cut financial exposure. The same risk models that power Edge’s client decisions also feed Resilience’s own underwriting. So a documented improvement in a client’s risk posture is among the factors weighed at renewal. But she stopped well short of promising a result. “We don’t guarantee a coverage outcome from platform use, and results vary,” she said. Terms depend on the complete submission and the client’s specific circumstances, not on the platform alone.
The honest reading is: maybe, sometimes, depending on the account. Resilience did not claim Edge clients see better limits, lower retentions, or fewer exclusions as a documented pattern. It claimed risk posture is one input among many at renewal. That is a more measured assertion, and a fair one.
The Board Liability Question Cuts Both Ways
The sharpest answer came last. It is the one most relevant to general counsel reading this from the litigation side rather than the underwriting side.
Quantification platforms like Edge raise a new question for boards. If a company can rank its cyber exposures by dollar impact, does that lift the bar for what directors should have known before a breach. Kumarjigud rejected the premise. “Knowing which exposures carry the most financial risk doesn’t make all of them avoidable: vendor risk is a leading loss driver but can’t be eliminated,” she said. Social engineering and identity attacks resist clean remediation, too, because they are diffuse by nature, not tied to a single fixable control.
What quantification and prioritization deliver, in her framing, is a credible account a security leader can carry to a board. Here is how we allocated resources against the risks most likely to cause material loss. That is a record of diligence, not a guarantee of prevention.
The framing is more useful to general counsel than either reflexive read. One says quantification hands plaintiffs a new weapon, proof of what the board should have known. The other says it builds a shield, documented proof the board did its homework. Both miss the point. A ranked, dollar-denominated action plan is evidence either way. A board can point to it as proof it acted on the best data available. A plaintiff’s attorney can point to the same document as proof the board saw the ranking and chose not to act on the top item. The record cuts in opposite directions depending on what the board did with it.
The Pattern Behind The Platform
Edge’s anniversary numbers arrive with two other figures. Clients cut time spent on risk and control assessments by roughly 65%. They hit a 77.4% remediation rate on critical findings surfaced through Resilience’s Risk Operations Center over the three-year period. Those metrics are narrower and more directly observable. Time spent on a task and findings closed are things a company can count, not things a model has to predict, and they give the broader claim a foundation.
This is also not Resilience’s first attempt to put a dollar sign on improvement. When the company launched Arc, its multi-entity platform, in May, it cited clients lowering portfolio risk assessment costs by up to $900,000 a year and cutting board reporting time by 75%, figures it described at the time as real results rather than estimates. The distinction between “real results” language for Arc’s operational metrics and “modeled exposure reduction” language for Edge’s billion-dollar figure is consistent and, on this evidence, honestly applied.
Edge’s growth, and the extension of its approach into Arc and the new private equity program launched in early June, suggests the model behind the billion-dollar number is becoming the connective tissue across Resilience’s product line. That line has widened steadily, from single-entity quantification to portfolio coverage to broadened Tech E&O in new markets. President of insurance at Resilience, George Kotsiopoulos, pointed to the expansion directly. Arc, he said, is “giving holding companies and PE-backed portfolios the same financial clarity across every subsidiary, portfolio company, and business unit” that Edge delivers at the entity level.
FAQ – Resilience Edge Extreme Loss Exposure
It refers to the high-severity tail end of a client’s Loss Exceedance Curve, the rare but catastrophic loss scenarios that matter most for solvency planning. It is a modeled projection, not a measure of claims that actually occurred.
No. Resilience says the number reflects the modeled difference in a client’s exposure before and after implementing controls from their Cyber Action Plan. It does not represent avoided claims or realized losses.
No. Resilience says risk posture improvement is one factor considered during underwriting, but terms depend on the full submission and individual circumstances. The company does not guarantee a coverage outcome from platform use.
Resilience argues it does not, since not every identified exposure, such as vendor risk or social engineering, can be fully eliminated. Instead, the company frames quantification as giving boards a credible record of how they allocated resources against the highest-priority risks.
Related Cyber Insurance Posts
- When an AI Agent Causes the Loss: Shadow AI and the Underwriting Questions It Raises
- AI Cuts Cyber-Insurance Claim Processing Times By > 80%?(Opens in a new browser tab)
- Lumen Warns Edge Device Security Risks Now Define Cyber Risk Exposure(Opens in a new browser tab)
- Better Risk Quantification Needed to Grease Skids for Cyber ILS: DeNexus/Artemis(Opens in a new browser tab)
- AI, Breakout Speed, And Edge Risk: What CrowdStrike’s Report Means For Cyber Insurance Underwriting(Opens in a new browser tab)