The aggregation study and the coverage study answer two different questions, and confusing them causes mis-reserving in both directions. Aggregation says who is exposed: how many insureds in a portfolio depend on the same host, the same publisher, the same certificate authority. Coverage says who is covered, and it says so from three conditions that have nothing to do with the outage itself. An interruption at a shared provider can strike three hundred insureds and produce no indemnity at all; a shorter interruption at the same provider can produce every one of them. Between the two, it is not the outage that changed, it is the contract.
The first condition bears on the cause. A conventional business interruption cover triggers on physical damage to insured property, and a cloud outage destroys nothing, touches no property of the insured, and happens at a third party. That is precisely the gap contingent business interruption came to fill, by accepting that the event occurs somewhere other than at the insured. But many wordings open only on a security failure at the provider, that is, on a malicious act. A faulty configuration update is not a malicious act. The outage is the same, the insureds' losses are the same, and the trigger simply never fires.
The second condition bears on duration, and this is where the loss curve stops being a curve. The waiting period runs on each insured, and it works as a threshold, not as a proportional deductible: until it is met there is no claim at all, rather than a reduced claim. An outage that stops one hour short of the threshold produces nothing across the whole portfolio; the same outage extended by one hour produces the entire portfolio at once. Aggregate loss, seen as a function of outage duration, is therefore a staircase and not a slope. Two scenarios the model files side by side because they differ by two hours can be separated by the whole book.
The third condition bears on the definition of the dependency. Some wordings cover only providers named on a schedule; others cover any provider the insured contracts with directly; very few reach the fourth-tier provider whose very existence the insured is unaware of. The single point of failure that matters is almost always deeper than the contractual relationship, because it is shared by the direct suppliers themselves. An exposure table counting insureds per named provider therefore systematically misses the concentration it exists to measure.
What this does to the model deserves to be stated bluntly: a portfolio's probable maximum loss on cloud is not proportional to its cloud exposure. It is the product of a binary on cause, a staircase on duration and a filter on the definition of dependency. Two portfolios with the same exposure, the same premium and the same number of insureds behind the same host can carry very different maximum losses, depending on whether their wordings open on any unavailability or on security failure alone. Nothing in an exposure table separates them. Only reading the wordings separates them.
The reverse error costs the insurer even more, and it consists in concluding from a narrow trigger that the exposure is small. The narrowness lives in the wording, and wordings drift at every renewal, broker by broker, line by line. A book built across four seasons carries several generations of contingent business interruption at once, some of which were broadened without the aggregation model being rerun. The calculation then runs on one generation of clauses while the portfolio holds three. It is a silent divergence, revealed only at the first mass event, which is to say at the worst possible moment.
Finally the two clocks have to be set against each other, the waiting period and the aggregation window, because they run on the same outage and in opposite directions. The waiting period delays the birth of the claim: the longer it is, the later the claim exists. The window, by contrast, imposes a deadline: past its term the claim still exists but no longer joins the event. On a long interruption, the claims most certain to exist, those of the most severely hit insureds, are also the most exposed to being born after the window has closed. The aggregation study and the wording study are therefore not two pieces of work that follow one another. They are one piece of work, and doing it in two passes yields an accurate figure to a question nobody asked.
A cedant studies its cloud aggregation. Three hundred insureds in its portfolio depend on the same host: two hundred policies carry a twelve-hour waiting period, one hundred an eight-hour one. The wordings fall into two generations, an older one opening contingent business interruption only on a security failure at the provider, a recent one opening it on any unavailability whatever its cause, and the book holds roughly as many of each. On April 8, a faulty configuration update at the host causes a nine-hour global outage, with no intrusion whatsoever. On October 15, ransomware at the same host causes a thirty-hour interruption. The cedant's aggregation model records an identical portfolio loss for both dates.
The model is wrong on both dates, and wrong in opposite directions, which is why nobody corrects it: the errors offset each other in the annual average and surface only on the day one of the two actually happens. On April 8 there is no security failure, so the entire older generation stays out of play whatever the duration. Within the recent generation, the twelve-hour policies do not clear their threshold on a nine-hour outage and produce nothing at all; only the eight-hour policies see anything, and for one hour of interruption beyond the threshold, which is to say almost nothing. The largest outage in the book produces a loss close to zero. On October 15, thirty hours clears both thresholds and ransomware is a security failure, so both generations respond and all three hundred insureds come in. The competent professional's error was to build the aggregation on dependency to the provider, which is a fact about the world, when the loss is decided by the generation of wording, which is a fact about the book. Dependency says who is exposed, wording says who is covered, and only the intersection produces an indemnity. There remains what the model sees in neither case: on April 8 all three hundred insureds notify, and examining three hundred files almost none of which will succeed is a real and immediate expense, covered by no one. An aggregation study that models only indemnities leaves that cost entirely outside the calculation.
- 01Aggregation says who is exposed, wording says who is covered: only the intersection of the two produces an indemnity.
- 02The waiting period is a threshold, not a deductible in time: portfolio loss as a function of outage duration is a staircase, not a slope.
- 03An accidental outage is not a security failure, and the largest outage in a portfolio may trigger no cover at all.
- 04An uncovered event still costs: three hundred notifications get examined, even when almost none of them succeeds.
- 05Wordings drift at every renewal, so a book carries several generations of contingent business interruption while the model knows only one.