The risk that makes itself
In orbit, a collision does not end when the two objects are destroyed. It scatters thousands of fragments, and each becomes a bullet that raises the odds of the next collision, which will scatter thousands more. There is a threshold past which this becomes a chain reaction, and low orbit turns into a shooting gallery that feeds on itself.
This is the Kessler syndrome, named after the researcher who described it decades ago. Past a certain debris density, collisions sustain themselves, even with no new launches. Long theoretical, the hypothesis has become a concrete concern as low orbit has filled with entire constellations, thousands of satellites where there were dozens. Insurers are asked to cover these craft at launch, in orbit and on failure, and the risk looks like almost nothing they price on Earth. It has nothing exotic about it. Its structure simply breaks the unspoken assumption all insurance rests on.
Here is the thesis. The Kessler cascade is a risk that manufactures more of itself. Insurance assumes losses are drawn from a stable distribution, that the probability of a loss does not change because another has just occurred. Here, each loss shifts the distribution and makes the next one more likely for everyone. It is anti-diversification in its purest form: a peril that gets worse by happening. Insurance has almost no tool for a frequency driven by its own past.
The stationary risk and the risk that is not
What makes this peril so foreign to insurance is a property usually taken for granted: stationarity. The fire at your neighbor's house does not raise the probability that yours will burn, the death of one insured does not bring another's closer, one car crash does not make the others more dangerous. On Earth, losses are mostly independent of one another, drawn year after year from the same urn, whose contents never change. That stability is what lets actuaries use the past to predict the future. They assume, often correctly, that tomorrow will look statistically like yesterday.
The Kessler syndrome violates this assumption in the most radical way. Each collision in orbit destroys two objects and also adds thousands of new fragments to the urn. The next loss is drawn from a different urn. The collision probability is no longer a constant to estimate. It rises with every collision that has already happened. One no longer draws from a fixed urn, one draws from an urn that fills with bullets at every draw. Such a risk cannot be priced once and for all, because every loss changes it. The history you study to forecast it is already out of date by the time you read it.
This property ruins, one by one, the actuary's methods. The development triangle, the frequency-severity law, extreme value theory, all assume a fixed distribution, or one that drifts slowly enough to be followed. A process in which each event raises the intensity of the next is the mathematical opposite. It self-excites and runs away, and no observation can estimate its tail until the cascade has run its course. Obviously, no one can wait that long to price it. So the insurer knows the peril exists and senses it would be catastrophic, but cannot put a number on its probability or its scale. The only data that could help would come from the disaster itself. No amount of modeling effort will change that.
A cliff, not a slope
This self-sustaining dynamic has a fearsome consequence for the insurer, it turns a gradual risk into a threshold risk. As long as debris density stays below a certain point, collisions remain rare and roughly independent, orbit behaves like an almost normal environment, and losses resemble those one knows how to price. Past that point, the feedback runs away and each collision breeds others. The regime flips at once from manageable to unmanageable. It is a cliff one sees only while falling, with no slope to price on the way down.
Yet insurance markets are terribly bad at pricing cliff risks, the ones that stay invisible until the tipping point and then become instantly unmanageable. We saw it with cyber, whose solvency rested on too short a history, and with the pandemic, whose hidden correlation was revealed only on the day it struck. The Kessler syndrome belongs to this same family, that of perils whose shape is unknown because they have not yet fully occurred. Until the cascade starts, orbit looks insurable: losses are sporadic and premiums hold. Once it starts, insurability collapses within a few years, and it is too late to rebuild a market around an environment no one can use anymore.
A book that is not diversified
What was only an engineer's hypothesis has become, in a few years, an industrial reality. For a long time, low orbit held a few hundred craft. It now hosts whole constellations of thousands of satellites built for global telecommunications, and launches keep accelerating. Avoidance maneuvers, once exceptional, are multiplying, close-approach alerts are becoming routine, and certain altitude shells concentrate an unprecedented density of objects. The in-orbit market has already felt it: capacity is tightening and terms are hardening. Insurers are wary of an environment that changes faster than their models. In February 2009, over Siberia, the American Iridium 33 and the defunct Russian Cosmos 2251 collided. That first accidental collision between two intact satellites produced more than two thousand cataloged fragments on its own. The Kessler threshold is no longer abstract, and people now argue about how far off it is.
This concentration hits the insurer's own book directly. Covering many satellites in the same orbital shell builds an accumulation, because a single cascade would hit all of them at once. A book that looks spread over dozens of operators would turn out, on the day of the tipping point, to be a single bet on one environment. This is the same hidden correlation we described for the pandemic: risks believed independent that share a common cause, here orbit itself. Reinsurance usually helps by spreading risk geographically, and it can do nothing here. For this peril, there is nowhere to spread it. The debris cloud ignores the borders that keep diversification alive.
The sky has no outside
A second property, geographic this time, takes away the insurer's usual fallback. On Earth, reinsurance depends on there being an elsewhere. It covers regions that are not hit at the same time and counts on a hurricane sparing a thousand other coastlines. In orbit, there is no elsewhere. Everyone in an orbital shell shares it. A debris cloud there knows no border and hits satellites from every operator and every country. Space risk shares the pandemic's blind spot: there is no outside to diversify into, because the loss zone is the whole zone.
Then there is the blind spot we already met with war: attribution. When a fragment destroys a satellite, it is usually impossible to trace it to an object, a launch or a state. Space law does make states liable for the objects they launch or have launched. In practice it is nearly unenforceable, because no one can trace a shard a few centimeters across moving at several kilometers a second. Without attribution, no effective liability, and without liability, the polluter never pays for the debris it sowed. The Kessler syndrome thus brings together, for the first time in a single peril, three blind spots that earlier pieces in this series took one at a time: non-stationarity, the absence of an outside and impossible attribution.
The tragedy of the commons, at five hundred kilometers
Underneath these three properties lies a problem older than insurance: the commons. Low orbit is a shared resource that every player wants to use and no one wants to protect alone. One more satellite pays off for whoever launches it. The cost, more congestion and a higher collision risk for everyone else, falls on the operators as a group. It is a classic negative externality, and insurance is structurally unable to correct it, because it prices the individual risk of an object, not the collective degradation that object inflicts on the shared environment. The premium can reflect the fragility of a satellite, it will never capture the harm that adding this satellite imposes on all the others.
In fairness to the reassuring case, it holds part of the truth. Today, orbit remains sparse enough that losses appear independent and can be priced, space insurance exists, it covers launches and life in orbit, it pays and it thrives. Some even argue the market will end up internalizing the problem, by raising the price of insurance on crowded orbits, by rewarding craft able to deorbit cleanly, by making debris a cost the price incorporates. This is the hope of a market solution to the tragedy of the commons, and it is not absurd so long as one stays on the right side of the cliff.
But it is precisely the cliff that ruins this hope. A market can only internalize a cost it can measure. Cascade risk stays invisible until the tipping point, then becomes infinite. The price will not rise gently to signal the danger, it will jump at once from insurable to uninsurable, leaving no time to adjust behavior. As for the externality, no private insurer can correct it alone, for no individual contract makes an operator pay for the degradation it imposes on the common orbit. As with the pandemic and war, the only answer big enough is collective governance: orbital traffic rules, deorbiting requirements, active debris removal. These tools are beyond what insurance can do, and they need a public or international institution.
One last loop deserves noting, for it makes the insurer's decision physically active. If insurers withdraw from orbit, launches become harder to finance, for want of cover, exactly as a home becomes unsellable when it ceases to be insurable. This withdrawal would slow the congestion, which would be good, but it could also leave the field to the only actors able to do without insurance, states or integrated giants, less careful about the cleanliness of their orbits, which would worsen the harm. The decision to insure or not does not merely reflect space risk, it shapes it, as we saw with climate, where the retreat of insurers made the peril they fled a little more certain.
The loss that does not recede
There is one last trait that sets the orbital peril apart from almost all others, its irreversibility. A hurricane season ends, a pandemic recedes, a hard market softens again, and insurance counts precisely on this return of calm to recover after the difficult years. Debris does not recede. At many altitudes, a fragment placed in orbit remains there for decades, sometimes centuries, before atmospheric drag brings it down. Orbital pollution does not decay on the timescale of insurance, it accumulates. So there is no year after when the environment heals. The damage is cumulative and near-permanent. Diversification over time, the bet on better days ahead, no longer works: in orbit, the days ahead are only more crowded.
This last trait seals the diagnosis. Space peril undoes at once diversification across space, for want of an outside, diversification across time, for want of a return to normal, and stationarity, since it worsens by occurring. It thus gathers, in a single object, everything that makes a risk resistant to insurance, and adds its own signature, self-propagation. This is why it deserves a place apart in the mapping of the century's risks, not as a curiosity for engineers, but as the laboratory where one sees, in pure form, what happens when a peril escapes, all at once, every grip insurance has.
Insure the satellite, not the sky
Space insurance can cover the satellite, it cannot cover the sky. It prices the individual object while the real risk is the shared orbit all objects poison together, a tragedy of the commons at five hundred kilometers of altitude. The insurer can see the cascade coming, model it, dread it, it cannot stop it, because the instrument it holds, the price of a policy, acts on one craft at a time and not on the common resource those craft degrade.
There is a lesson here that goes beyond space. The Kessler syndrome is the pure case of a risk that individual pricing cannot govern, because the peril is collectively produced and amplifies itself. It is the point where insurance reaches its sharpest limit, it knows how to carry a risk that strikes from outside, it does not know how to carry a risk the insured make together and that strengthens with each realization. The day the chain reaction ignites, there will be nothing left to insure but the memory of an open sky, and it will be understood too late that the orbit had to be governed before it could be insured. The price of a lost satellite can be calculated; the question the debris leaves is who protects the void we thought infinite and are now closing. For low orbit was, until now, one of the few commons humanity had not yet saturated, a space so vast it seemed safe from scarcity. We are discovering it is not, that a narrow ring around the Earth can clog like a road, and that clogging it could close our access for generations. Insurance will not do this work, it has neither the means nor the mandate, but it will be the first to stop paying when the work has not been done.
Further reading: the founding work on the Kessler syndrome and critical debris density, the analyses of the liability regime born of space law and its difficulty of enforcement, and the literature on the tragedy of the commons applied to orbital resources illuminate the limits of space insurability.
See also AlgoPolis foundational article 17, modeling space risk, which details debris, accumulation and the role of institutions.
By Nystrøm Legrand
The Modeling of Space Risks
Of thirteen thousand active satellites, barely three hundred are insured, for some $600m of premium a year. What blocks cover is the model, not the danger: scarce data, debris too small to track, the Kessler syndrome, and a risk the insured activity creates itself.
The Cyber Insurance Market for Hospitals
The Change Healthcare attack affected 192.7 million people, and in-hospital mortality rises from 3 to 4 per 100 during a ransomware attack (University of Minnesota). A cyber claim runs through every cover up to bodily injury, and accumulation runs through the vendors hospitals share.
Pandemic Reinsurance: After Covid, What Market?
Covid cost insurers $44bn, everywhere at once, and the diversification reinsurance lives on did not work. Wimbledon collected about $141m after seventeen years of pandemic premiums; the World Bank's pandemic bonds paid forty days after the WHO declaration. The risk can now be carried only by a public-private partnership, pooling over time what cannot be spread across space.
A contract that pays itself
The rain did not fall, a satellite saw it, and the money reaches the farmer's account before he has declared anything at all. No one came to measure his loss. The contract paid itself, and that autonomy changes the very nature of what insurance is.
Did insurtech lie?
The promise was to do to insurance what others had done to taxis and hotels. Buy coverage in ninety seconds, be paid by an algorithm, pay a price cut by data. A decade later, the incumbents are still standing and many of the disruptors have vanished, been absorbed, or turned into something far more modest than their pitch.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.