Conditional Value at Risk (CVaR)

Conditional Value at Risk, also called expected shortfall, is the average loss across the worst outcomes beyond a chosen confidence level. Where Value at Risk at 95% tells you the loss you will exceed only 5% of the time, CVaR at 95% tells you how bad things are on average when you do exceed it.

CVaR matters in cyber because losses are heavy-tailed: most years are quiet and a few are catastrophic. VaR alone can understate that tail. Reporting the two together — “a 5% chance of losing more than $1.3M, and when we do, the average loss is $1.9M” — gives leadership both the threshold and the shape of what lies past it.