Accumulation and aggregation

In June 2017, NotPetya encrypted the networks of Maersk, Merck, Mondelez and Saint-Gobain within hours, companies with nothing in common beyond a Ukrainian accounting package and Windows estates. Merck sought about $1.4 billion from its property insurers; Mondelez litigated against Zurich until a 2022 settlement. That is accumulation, or aggregation: exposures written as independent, hit by one event, turning into one loss. The concept comes from nat cat, where a single hurricane strikes thousands of policies in the same zone; there the correlation is geographic and can be mapped. In cyber it is logical. It follows shared digital dependencies (a software vendor, a cloud provider, a security agent, a flaw like Log4Shell) and ignores distance. On July 19, 2024, a faulty CrowdStrike update took down 8.5 million Windows machines with no malicious intent at all, which also tests how far policies respond to non-malicious system failure. An insurer that ignores its correlations understates the maximum possible loss of its portfolio and under-reserves. The market manages aggregation through mapping of common providers, deterministic scenarios, sub-limits, exclusions (the LMA 5564 to 5567 cyber war clauses, one answer to Lloyd's Market Bulletin Y5381) and reinsurance. The weak spot is data: a few years of usable cyber loss history against more than a century of hurricane records, so every accumulation scenario is calibrated with a wide margin of error.