The simulator as a 90-minute class
A class plays the same game on the same day, with no account and no fee, then argues over two decisions that cannot be postponed. Here is the session minute by minute, with the debrief answers.
Open today's gameA question, a session to schedule: contact@algopolis.eu
Who it is for
A master's course in insurance or reinsurance that wants students to run a book rather than read a policy. A risk management course, for a supplier outage and what it costs nine hundred businesses on the same morning. An international relations course, because the game turns on a question of state: who attributes a cyberattack, and what a clause is worth while nobody signs.
The session, minute by minute
0 to 10, briefing. Put /en/simulator on the screen. Each student opens the game of the day on phone or laptop, no account. The frame in three sentences: you run an insurer's cyber desk for eight quarters, from 2025 to the end of 2026; each quarter brings files to accept or decline; twice, a decision that cannot wait.
10 to 15, the first quarter together. Read the Q1 chapter aloud: four files in the book sit with the same host, Amazonas Cloud. Let everyone sign their files.
15 to 35, first decision played: the Logipaie outage (round 3). Amazonas Cloud has been down for five days. Logipaie, a payroll provider, notifies: 900 businesses could not pay their staff. The policy covers a supplier failure, within its sublimit. The technical department proposes to decline, the broker wants an advance. Five minutes alone, a show of hands on the three options, three minutes of defence per option. Everyone commits in the game and reads the feedback.
35 to 45, solo play. Rounds 4 to 6: NoxLock sanctioned, the coup in Senegal, Rotterdam at a standstill.
45 to 65, second decision played: the Rotterdam attribution (round 7). The Hague cannot attribute the attack. Holland Container Terminals claims the business interruption of its three terminals; the claims team holds a security vendor's report and proposes to rely on the state cyber operation exclusion. Same drill: alone, vote, defence, commit.
65 to 70, finish. Round 8, then the closing page, where each real fact tells the player whether they were right.
70 to 90, debrief. The six questions below, three minutes each, the expected answer read out after the room has had its say.
The six debrief questions, and the expected answer
1. Why pay Logipaie's business interruption now, but not its 900 clients' claims? The business interruption is certain and measurable once the deductible period ends. The claims are not, and part of them will run into the limitation of liability in their contracts. Paying third-party claims before they are quantified gives up the defence the policy pays for.
2. Was the technical department right to decline, since no security was breached? No. The wording covers a supplier failure, malicious or not: the declinature fails and costs the relationship. The real precedent is the faulty update of 19 July 2024, 8.5 million Windows devices down: policies covering non-malicious failure paid, usually after an eight to twelve hour waiting period.
3. Who has to attribute a cyberattack for the state exclusion to apply? First, the government of the country where the affected systems sit (LMA 5564 to 5567, November 2021). Failing that, the insurer may rely on an objectively reasonable inference, which it has to prove.
4. Is the security vendor's report enough to decline Rotterdam? No: a code match is not an objectively reasonable inference. It holds once the country watch has put on file a state service that has targeted these systems elsewhere, and the policy carries clause B or C; under clause A, which excludes war only, declining leads to the case Merck's insurers lost on appeal.
5. What does a written reservation of rights buy over a clean payment? Whatever a later attribution might say. NotPetya, 27 June 2017, was only attributed to Russian military intelligence by London and Washington on 15 February 2018, eight months later.
6. What did the only court to rule on a war exclusion against a cyberattack decide? The New Jersey Appellate Division, 1 May 2023: the "hostile or warlike action" exclusion means war in the classic sense, not a cyberattack on a private company. Merck was claiming about $1.4 billion; the parties settled in January 2024.
For an international relations class, a seventh question arises in round 5 ("Dakar, then Moscow"): how does a coup in Senegal get into a cyber book? The chapter answers it: through the war clause.
After the class: what the Academy offers for free
Every course is free to read, with no account: modules, worked cases, a short questionnaire at the end. The short quizzes are free, with no account. The simulator can be replayed as often as you like. Link to share: algopolis.eu/academy.
Going further: certifications
A certification (a group of courses) costs €11.99 including VAT, a specialization (a group of certifications) €17.99 including VAT, once sales open. The statement that goes with them everywhere:
Private certification issued by AlgoPolis under its sole authority. It is not registered with France Compétences, in either the RNCP or the specific register, and does not qualify for the French personal training account.