All classical actuarial technique rests on a simple idea: the past informs the future, provided the mechanism producing losses stays stable. A motor book, a fire book, a decennial liability book have been priced this way for a century, because a driver in 2026 resembles one from 2019 and a building burns as it used to. Cyber does not meet that condition, and it will not: this is not a data shortcoming, it is the nature of the risk. Understanding why makes it possible to know what is put in its place, and above all not to replace a method with an intuition.
Three reasons compound and none is fixed by waiting. The first is that the adversary adapts: when a measure becomes common, attackers change path, so that the frequency observed last year describes a landscape that no longer exists. The second is that the underlying technology changes faster than the observation period: a company's IT estate in 2026 is not that of 2021, and a model calibrated over five years mixes different populations. The third is correlation, which forbids treating losses as independent: one vulnerability can strike thousands of insureds on the same day, which no fire book does.
What is put in its place is not a prediction but a body of evidence, and it is better said that way than claiming a science one does not have. The first element is exposure, measured on what produces the cost: number of personal data records held, daily turnover interrupted, dependency on a single system. The second is control maturity, taken in the sense of what they close rather than of their conformity. The third is sector, not out of convenience but because target and modus operandi genuinely depend on it. The fourth is event modeling, which replaces statistics with quantified scenarios.
That scenario modeling deserves to be understood for what it is. One does not ask the model the probability of a loss, a question nobody can answer; one asks what happens if a given infrastructure provider is unavailable for forty-eight hours, if a given family of software is massively exploited, if a given type of ransomware hits a sector. The model then produces a loss distribution conditional on a scenario, and the underwriter works on those amounts rather than on a frequency. It is less intellectually satisfying, and it is what is available.
One must then draw the pricing consequence that most offends insureds: a premium rising although no loss has occurred is not an anomaly. If a sector's frequency has tripled in eighteen months, last year's premium no longer describes this year's risk, and the absence of a loss at that insured is not information about its future risk but about its sample size, which is one. That is the exact opposite of what an operator expects from an insurance relationship, and it is why the renewal conversation is prepared with market figures rather than with the client's own history.
One last phenomenon deserves naming because it distorts market statistics: observed loss experience depends on the cover sold. When policies began covering business interruption without physical damage, the average loss jumped without the number of attacks having changed. A historical series mixing different cover perimeters therefore measures the evolution of contracts as much as that of attacks. An actuary who does not adjust for this sees a trend where there is a drafting reform.
The discipline comes to four habits. Never present a cyber premium as derived from the insured's own loss experience, because it is untrue and the client's first question will show it. Quantify exposure on what produces the cost, records and daily turnover, rather than on annual turnover. Work with quantified scenarios rather than estimated frequency. And adjust historical series for changes in cover perimeter before reading a trend into them, failing which one prices a contractual reform.
An insurer renews the policy of a specialist retail group, 340 million euros of turnover, no cyber loss notified in four years of relationship. Over the last eighteen months, ransomware frequency in that sector has tripled according to market data, and average severity has doubled, the latter rise being explained half by the broadening of business interruption cover in market contracts. The underwriter proposes a premium up 60 percent. The finance director replies that he has never cost anything and asks for a reduction. How should this conversation be held?
Both parties are right on their own ground, and that is what makes the conversation difficult rather than dishonest. The finance director observes an accurate fact, no loss in four years, and draws a false conclusion from it: four years without a loss at one insured informs about its sample size, which is one, and not about its future risk. In cyber, the adversary adapts, technology changes faster than the observation period, and losses are correlated: this insured's past does not price its future, and saying so frankly is better than dressing the increase up as a commercial argument. The underwriter, for its part, must revisit its own figure before defending it. Sector frequency has tripled, which is real information about the risk. But average severity doubled only half because of attacks: the other half comes from the broadening of business interruption cover in market contracts, that is, from a drafting reform and not a deterioration. A series not adjusted for that change in perimeter measures the evolution of contracts as much as that of attacks, and a 60 percent increase built on it prices, in part, a contractual reform. The useful conversation therefore turns on three figures and not on history: this group's real exposure, measured in daily turnover interrupted and records held; what its controls close, offline backup and segmentation foremost; and an increase adjusted for the change in perimeter, which will be lower and defensible.
- 01Cyber does not meet the stability condition underpinning classical actuarial technique, and that is not a data shortcoming but the nature of the risk.
- 02Four years without a loss at one insured informs about its sample size, which is one, not about its future risk.
- 03Estimated frequency is replaced by quantified scenarios: what a given provider's unavailability costs, not the probability that it occurs.
- 04Exposure is measured on what produces the cost, records held and daily turnover, not on annual turnover.
- 05A historical series mixing different cover perimeters measures the evolution of contracts as much as that of attacks.