A per-event structure answers one question and one only: what happens if a loss is very large. It says nothing about how many times. How many times is called the reinstatement, it sits on one line at the bottom of a table, and on a peril whose frequency is rising it is the parameter that decides the year. A program therefore reads badly line by line: it can only be understood by running it across a whole year, with losses arriving in a certain order and on certain dates.
Mechanically, a reinstatement restores the cover after a loss has consumed the layer, a defined number of times, most often against an additional premium. That premium is computed pro rata to the amount consumed, and frequently also pro rata to the time left to run. This second proration produces an effect nobody anticipates while reading it: a loss occurring in the second month costs an almost full reinstatement, whereas the same loss in the eleventh month costs almost nothing. It is therefore the calendar that prices the reinstatement, and the calendar is not risk.
The first place where two rules meet is this. A per-event layer protects against severity. An annual aggregate protection, or an annual aggregate deductible, protects against frequency. The two answer different fears, they are often bought in different years, sometimes from different reinsurers, and a cyber year delivering both a mass event and sustained ransomware frequency defeats a program built against only one of the two. The useful question is not which of the two protections is better, it is which of the two configurations the portfolio actually produced last year.
The second point is specific to cyber and comes down to the absence of a season. In natural catastrophe, an early event leaves the cedant exposed for a known window, and that window closes: past the fall, hurricane risk drops, and a layer exhausted in August becomes bearable again in December. In cyber there is no season. A layer exhausted in the second month leaves ten months of uniform exposure, with no calendar coming to the balance sheet's rescue. The same structure, with the same amounts, therefore does not protect the same way depending on the line it is applied to, and that difference never shows on a program summary.
The third point closes the question opened by the aggregation window. We saw that a cedant may have an interest, on identical facts, in declaring two events rather than one, because the aggregate exceeds the layer's limit and a second retention costs less than the excess forgone. That optimization carries a hidden price: two events consume two reinstatements instead of one. A cedant maximizing recovery on its March loss can find itself without cover in September, and the calculation that led it to split was right on the loss and wrong on the year. The correct objective is not the net recovery of this claim, it is the net recovery of the year.
The annual aggregate deductible works the other way and holds a symmetrical disappointment. Sitting ahead of the layer, it absorbs frequency until a cumulative threshold is met, which means the first losses of the year produce strictly nothing. A portfolio whose frequency is rising and whose severity is falling, which is exactly what a market where ransoms are negotiated down but multiply produces, can thus pay for a full program and recover nothing at all over an entire year. The program did not fail: it answered a question the portfolio did not ask.
What a program covers is therefore not a set of clauses read one after another, it is a path through a year. Two programs carrying the same layers, the same limits and the same premiums behave differently depending on the order and the dates on which losses arrive. The practical consequence is that a program is tested by running it over trajectories, including improbable ones, rather than by checking that each line taken in isolation looks reasonable. A reasonable line inside a program that is not reasonable remains a reasonable line, and that serves no purpose.
A cedant protects its cyber portfolio with a layer of 40 million euros of limit above a 10 million retention, per event, with a single reinstatement, pro rata as to amount and as to time. The year unfolds as follows: in February, a mass event for 55 million of ceded losses; in June, a second for 48 million; in October, a third for 30 million. In preparing the renewal, the underwriting committee had concluded that the program covered two large events.
The committee was right about the two events, and that is exactly what makes its error hard to see: the sentence is true, it is simply unrelated to the question. In February the layer pays 40 million, its entire limit, and is exhausted; the cedant retains 10 million of retention plus 5 million above the top of the layer. The single reinstatement operates, and since it is pro rata as to time with ten months remaining, it costs close to a full premium, immediately, at the worst possible moment for cash. In June the reinstated layer pays 38 million and the cedant retains its 10 million retention. Only 2 million of limit then remains and no reinstatement at all. In October, on 30 million, the layer pays only that 2 million and the cedant retains 10 million of retention plus 18 million unprotected, that is 28 million on a single event, more than in February where the loss was nonetheless heavier. Total retained over the year, 53 million, plus the reinstatement. The lesson is not that more reinstatements were needed, it is that the program was tested against a severity question while the year asked a frequency question. And the link with the aggregation window is direct: had the cedant in February split the facts into two events to recover the 5 million lost above the layer, it would have consumed its reinstatement in February, and both June and October would have stayed entirely for its own account. The optimization that gains fifteen million in March can cost forty in September.
- 01A per-event layer answers severity, the reinstatement answers how many times: on a peril whose frequency is rising, the second decides the year.
- 02A reinstatement pro rata as to time is priced by the calendar: a loss in the second month costs nearly a full one, the same loss in the eleventh almost nothing.
- 03Cyber has no season: a layer exhausted early leaves uniform exposure through year end, with no window closing to help.
- 04Splitting one loss into two events consumes two reinstatements: the correct objective is not this claim's recovery but the year's.
- 05A program is not read line by line, it is run over trajectories: a reasonable line inside an unreasonable program serves no purpose.