  There are two strategic and longstanding questions about cyber risk that
organizations largely have been unable to answer: What is an organization's
estimated risk exposure and how does its security compare with peers? Answering
both requires industry-wide data on security posture, incidents, and losses
that, until recently, have been too sensitive for organizations to share. Now,
privacy enhancing technologies (PETs) such as cryptographic computing can
enable the secure computation of aggregate cyber risk metrics from a peer group
of organizations while leaving sensitive input data undisclosed. As these new
aggregate data become available, analysts need ways to integrate them into
cyber risk models that can produce more reliable risk assessments and allow
comparison to a peer group. This paper proposes a new framework for
benchmarking cyber posture against peers and estimating cyber risk within
specific economic sectors using the new variables emerging from secure
computations. We introduce a new top-line variable called the Defense Gap Index
representing the weighted security gap between an organization and its peers
that can be used to forecast an organization's own security risk based on
historical industry data. We apply this approach in a specific sector using
data collected from 25 large firms, in partnership with an industry ISAO, to
build an industry risk model and provide tools back to participants to estimate
their own risk exposure and privately compare their security posture with their
peers.
