Cyber risk is not a single story. On one side are the “typical” losses that shape most FAIR models; on the other are the rare but extreme events that redefine expectations and dominate boardroom conversations. Drawing on Cyentia’s IRIS series, including the forthcoming 2026 IRIS Xtreme, this talk explores what thousands of real-world incidents reveal about both ends of the distribution. We will contrast median losses with catastrophic tails, show how public data and the collective “wisdom of the crowds” refine our understanding of likelihood and impact, and discuss what this means for practitioners seeking realism in their risk estimates. Expect insights rather than prescriptions, with a focus on how empirical data can both ground and challenge our FAIR assumptions.
