System and method for evaluating an organization's risk for exposure to cyber security

A computerized method for evaluating an organization's risk to be exposed to cyber security events, the method comprising:

• collecting security-based risk indicators about multiple organizations and an indication on whether or not each of the multiple organizations suffered a security event;
• inputting values of the security-based risk indicators about the multiple organization into a software model;
• running the software model multiple times, the software model outputs multiple sets of one or more classifiers, each set of one or more classifiers distinguishes organizations that suffered the security event from organizations that did not suffer the security event, wherein the one or more classifiers comprise classifiers selected from the security-based risk indicators;
• assigning a risk score for a specific organization according to the importance of specific classifiers related to the specific organization;
• and
• computing an underwriting score for the specific organization, wherein said computing comprises
• comparing a type-based risk score for the specific organization to a type-based benchmark value representing a standard risk score in a specific risk type of multiple other organizations of a reference group having similar characteristics with the specific organization,
• assigning a risk-based value based on the risk-based comparison, and
• accumulating multiple risk-based values for a group of relevant risk types.