What a cyber policy pays and in what order, from response costs to ransom by way of a business interruption that triggers with no damage at all; then what happens when a treaty aggregation clause written for a windstorm meets an attack that replays in waves, and when a war exclusion inherited from the last century meets a state attribution that lands months after settlement.
Cyber·5 courses, about 1 hr each
Who it is for
Cyber underwriters, claims handlers, specialist brokers, incident response managers, reinsurance actuaries and brokers, compliance counsel.
What you will be able to do
- ·Place the start hour of an aggregation window and say what that choice changes in a cedant's net recovery.
- ·Compute what a cedant retains depending on whether it declares one event or two on identical facts.
- ·Separate an event anchored on the cause from one anchored on the manifestation, and say which of the two can close the window before the first loss occurs.
- ·Read a cyber war exclusion and say whether it conditions the exclusion on official attribution or on the insurer's own assessment.
- ·Spot, within an insurance tower, the drafting gap on attribution that opens a hole between two lines.
- ·Name which of the four covers in a cyber policy responds first, and say why the order in which they are called decides the final amount.
- ·State what response costs pay, why the panel of providers is imposed, and what the order of the first calls does to the investigation report.
- ·Compute a cyber business interruption loss on a partial recovery, from the waiting period to the return to expected activity.
- ·Separate civil from regulatory exposure after a data breach, and say what defence costs eroding the limit do to the compensation.
- ·Set the cost of a full rebuild against a ransom demanded, and name the conditions without which a payment is not reimbursed, including the one French law adds to the contract.
- ·Place a phased notification between an awareness clock and an investigation that is not finished, and distinguish it from informing the individuals concerned.
- ·Translate a closed questionnaire question into a named perimeter and a percentage of estate, and distinguish what the contract takes up as a declaration from what it takes up as a condition.
- ·Rank technical controls by what they close rather than by their place in a framework, and separate what reduces frequency from what reduces severity.
- ·State why an insured's past loss experience does not price its cyber risk, and name what replaces it.
- ·Compute, on a profile of interruption durations, what a monetary deductible and a waiting period respectively leave with the insured.
- ·File a submission between what gets priced, what gets conditioned and what gets declined, and distinguish a defect of the insured from a portfolio aggregation.
- ·Situate the three levels of attribution in a forensic report, and say which one a cyber war exclusion requires depending on its drafting.
The syllabus
What does a cyber policy cover, and in what order?
Course · 6 modules · about 45 min
- 01The four families that get confused · 7 min of reading
- 02Response costs, or the cover consumed first · 8 min of reading
- 03Business interruption, and the meter that starts without damage · 7 min of reading
- 04Third-party liability, and what the policy does not repair · 7 min of reading
- 05The ransom: paying, not paying, and what the policy allows · 8 min of reading
- 06Regulatory notification, and the clock that runs · 8 min of reading
One event or several?
Course · 7 modules · about 1 hr
- 01Technical attribution, and what a forensic report actually establishes · 8 min of reading
- 02The aggregation window, or how claims become one event · 9 min of reading
- 03The cloud outage, or why the largest aggregation is not the largest loss · 9 min of reading
- 04The cyber war exclusion, or who decides attribution · 10 min of reading
- 05Reinstatement, or what is left after the first large loss · 8 min of reading
- 06Physical damage in industrial cyber, or the boundary that decides the line · 8 min of reading
- 07Sanctions, or the aggregation that strikes the cover, not the loss · 10 min of reading
What does an underwriter look at before saying yes?
Course · 6 modules · about 1 hr
- 01The questionnaire, or declaring an information system · 8 min of reading
- 02The controls underwriting actually looks at · 8 min of reading
- 03Pricing without history: what replaces loss experience · 8 min of reading
- 04The deductible, the waiting period, and what they buy · 8 min of reading
- 05Declining, or when a cyber risk is not underwritten · 9 min of reading
- 06The subsidiary nobody looked at · 9 min of reading
Where does cyber hide in the other policies?
Course · 6 modules · about 1 hr
- 01A policy that says nothing about cyber says something · 9 min of reading
- 02How the market ended up here · 8 min of reading
- 03Three families of clause, and the one you hold · 9 min of reading
- 04The cyber loss that lands in a policy that never mentions it · 8 min of reading
- 05The ship whose navigation stops · 8 min of reading
- 06The table no broker has drawn up · 8 min of reading
Who decides that a cyberattack is an act of war?
Course · 6 modules · about 1 hr
- 01Where the four clauses come from, from NotPetya to Bulletin Y5381 · 9 min of reading
- 02What each clause excludes and what it keeps, word by word · 9 min of reading
- 03The impacted state and attribution, or the geography of an exclusion · 8 min of reading
- 04Merck and Mondelez, what the judges read · 9 min of reading
- 05A claim worked step by step, from notice to the excluded part · 10 min of reading
- 06What the underwriter asks for in the file, before deciding · 9 min of reading
Validation
Each course is validated by its questionnaire: a few easy questions, open to all, at the pass mark below. The specialization is validated once all its courses are, with no further questionnaire at this level. This check, unproctored and with a public answer key, does not prove knowledge under supervision.
6 questions per course·Pass mark: 5 out of 6
What this specialization does not prove
This program attests to an understanding of what a cyber policy covers, of aggregation mechanisms and of the reading of exclusion clauses. It attests to no underwriting experience, no professional authorization, and it prepares for no regulatory examination.
Your progress
Each course is validated by its questionnaire. The specialization certificate comes once all its courses are passed, with no further questionnaire at this level. Your progress is kept in this browser.
0 of 5 courses passed
- What does a cyber policy cover, and in what order?To do · 6 questions, 5 minutes
- One event or several?To do · 6 questions, 5 minutes
- What does an underwriter look at before saying yes?To do · 6 questions, 5 minutes
- Where does cyber hide in the other policies?To do · 6 questions, 5 minutes
- Who decides that a cyberattack is an act of war?To do · 6 questions, 5 minutes
The certificate will be available soon.
Private certification issued by AlgoPolis under its sole authority. It is not registered with France Compétences, in either the RNCP or the specific register, and does not qualify for the French personal training account.