How Hard is it to Estimate Systemic Enterprise Cyber Risk?

Systemic enterprise cyber risk typically arises when a single (software) vulnerability common across many enterprise computing devices across the globe is exploited by adversaries, and results in catastrophic aggregate cyber-loss consequences to be borne by CRM entities. Examples of such vulnerability exploitation incidents include the Log4j and SolarWinds cyber-attacks. The important question we ask here is: how hard is it to discover these ‘single vulnerabilities' in enterprise information systems? We prove that answering this question is NP-hard. Alternatively, leave alone humans, even a computer via cyber-attack simulations might not (in the worst case) discover in finite time such vulnerabilities. Consequently, CRM entities can only expect and prepare for an inevitable catastrophic systemic cyber-incident in time rather than predict the likelihood of one. Likewise, we propose the policy implications of our research for the CRM market stakeholders and elucidate relevant action items for effective systemic enterprise CRM.