System and method for evaluating an organization's risk for exposure to cyber security events

A computerized method for evaluating an organization's risk to be exposed to cyber security events, the method comprising:

• collecting security-based risk indicators about multiple organizations and an indication on whether or not each of the multiple organizations suffered a security event;
• inputting values that represent the financial damages of the security events and values of the security-based risk indicators about the multiple organizations into a software model;
• running the software model multiple times, wherein each run evaluates a respective combination of two or more classifiers selected from the security-based risk indicators and outputs a set comprising the respective combination of the two or more classifiers and a damages value associated with one or more security events attributable to that respective combination, the software model outputs multiple sets of the two or more classifiers, each set of the sets of the two or more classifiers distinguishes organizations that suffered the security event from organizations that did not suffer the security event;
• wherein each run of the model is associated with the financial damages of the security event;
• accumulating, for each classifier, the damages values across the sets of the two or more classifiers in which that classifier appears;
• assigning, to each classifier, a weight based on a function of the accumulated damages values across the sets of the two or more classifiers in which that classifier appears, wherein the weight reflects the financial impact attributable to that classifier based on one or more occurrences in the respective combinations.