Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. The module says a sanctions listing does not correlate losses. What does it correlate?
Impediments: exposure does not move, the right to pay disappears everywhere at once
It is an accumulation of a different nature from those a model can represent: nothing more is lost, and yet every file tips together. An aggregation model looks for correlated losses and sees nothing pass, because what is correlated here is a legal capacity and not an amount. The answer speaking of frequency even reverses the direction: a listing does not increase attacks, it changes what one is allowed to do about those already occurring.
Glossary entry →2. What is the difference between a sanctions impediment and an exclusion?
The cover still exists, it has become unlawful to perform: the contract withdrew nothing, the law withdrew the ability to perform it
The distinction is not theoretical, it changes who bears the risk and under what regime. An exclusion is argued on contractual ground, with the burden on whoever invokes it. A sanctions impediment falls under strict liability, which strips good faith of any effect and exposes the insurer personally, not merely financially. The answer treating them as equivalent in practice looks only at the immediate outcome for the insured, and misses that the consequences, the remedies and the liabilities are not the same at all.
Glossary entry →3. In the worked case, business interruption runs at 180,000 euros per day and the shutdown has lasted sixteen days when the keys are made available. What does that figure say about the 1.9 million saved on the ransom?
That sixteen days already amount to 2.88 million, more than the ransom: the saving lands on the file's smallest head
Sixteen days at 180,000 euros is 2.88 million, and the arithmetic puts the file the right way up: the ransom is the visible head, it is not the heavy one. The keys still have to work on this variant and restoration has to be faster than negotiation would have been, which is never a given. A takedown reads as good fortune, and that is the error: three distinct things happened at once and only one of them is good. The other two are that the sanctions question was never settled but overtaken, and that other insureds in the portfolio are in the same position at the same moment.
Glossary entry →4. The module says action by the authorities against a group can either forbid a payment or make it pointless. Why does that ambivalence matter?
Because nothing in the risk says which of the two effects arrives first, whereas the consequences for the insurer are opposite
Making a payment pointless is good news that saves one head of the file; forbidding it is a strict liability exposure that can reach the insurer personally. Both effects arise from the same fact, action by the authorities, and nothing allows one to predict which will occur or in what order. That is why the only genuinely controlled variable is when the sanctions question is asked: on day one it steers the file, at the moment of transfer it changes nothing. The answer leaving the choice to the insured confuses a legal characterization, which is imposed, with a file strategy, which is decided.
Glossary entry →5. The module criticizes an aggregation model indexed on group names. What does such a model actually measure?
A naming convention: affiliates migrate from one name to another, real frequency persists, and the statistic falls
The ransomware-as-a-service model separates the infrastructure from the affiliates using it, so a group name designates a brand rather than a stable membership. When action by the authorities makes a name disappear, affiliates move elsewhere and the statistic records a fall the risk never experienced. It is the costliest measurement flaw of the lot, because it produces an apparent improvement at precisely the moment when vigilance should not be relaxed. The answer seeing it as a market share proxy assumes a stability of perimeters this business model excludes by construction.
Glossary entry →