The aggregation window, or how claims become one event

A cyber policy and a reinsurance treaty do not count the same thing, and that gap is where most year-end surprises come from. The policy triggers insured by insured: it has its own triggering event, its own waiting period, its own deductible, and it knows nothing of the other insureds in the portfolio. The per-event excess of loss treaty, by contrast, knows nothing of the insureds. It knows an event, a retention and a limit. What connects these two sets of books is not the reality of the attack but a drafting clause, the aggregation clause, which states the conditions under which legally distinct claims become one single claim in the reinsurer's eyes. Until you have read it, you do not know what you bought.

That clause was not written for cyber. It comes from physical perils, where an event has an observable duration: a windstorm crosses a territory, an earthquake happens, its aftershocks space out, a riot burns itself out. The event is then bounded by a time window, often seventy-two hours for wind and longer for other perils depending on the treaty, and everything falling inside the window aggregates. The device is robust because the time boundary tracks a physical reality: past the deadline, the peril has materially stopped acting. Transposing it to cyber kept the form of the clause and lost precisely what grounded it.

Because a cyber event has no natural duration. Propagation there is logical rather than geographical: an implant can lie dormant for weeks before activation, encryption can fire in successive waves following time zones or target value, and a persistence mechanism can replay the attack after a restoration everyone believed was complete. None of this is a pathology of the claim. It is the operating method, chosen by the attacker precisely because it maximizes effect and complicates response. The consequence for the treaty is brutal: the duration of the event, which was a fact of nature under a natural peril, becomes in cyber a variable the adversary partly controls.

The start hour of the window is elective. The cedant chooses it, chooses it once, and that choice is not remade. The counterintuitive consequence has to be drawn: this choice is not narrated, it is computed. The only useful question is which position of the window maximizes net recovery, and the optimal position is almost never that of the most visible fact. A cedant that starts its window when the press named the attack, or when its own operations center opened a crisis room, has let a third party write its clause for it. The sound reflex is to build the timestamped chronology of the claims before choosing, then slide the window across that chronology.

Aggregating is not always favorable either, and that is the second common misreading. A single event means one retention to bear, but it also means one limit to consume. As soon as aggregate losses exceed the layer's limit, the excess falls back entirely on the cedant, which has paid a retention for a ceiling it broke through. Splitting the same facts into two events costs a second retention and can, beyond a certain level of loss, recover more, provided the second cluster reaches its own retention. There is therefore no position that is favorable in principle. There is arithmetic, and it changes answer depending on the amount reached and on the number of reinstatements available.

On top of this sits a mismatch that reading the treaty alone never reveals, the one created by the underlying policies. Each policy carries its own waiting period, and that period runs on the insured, not on the event. A policy whose waiting period is not met produces no indemnifiable claim, therefore nothing to cede, even though the attack sits squarely in the middle of the aggregation window. Conversely, a policy whose waiting period is running gives birth to its claim after the window has closed, and that very real claim finds itself orphaned of any event. Two clocks are turning, one on the portfolio and one on each insured, nothing synchronizes them, and the gap between them widens precisely on the slowest files, which are also the heaviest.

That leaves the question that decides everything and that cannot usefully be argued after the fact: is the event anchored on the cause or on the manifestation? Drafting that anchors it on the initial compromise starts the window from an intrusion often predating the first damage by several months, which can close it before any claim occurs at all, gutting the protection without a single exclusion being invoked. Drafting that anchors it on the manifestation produces the opposite effect and lets one compromise generate as many events as there are waves, therefore as many retentions. Both wordings exist, they look alike on a quick read, and the gap between them runs into tens of millions on one and the same loss. It is a placement sentence, not a claims sentence.