Hours clause
A reinsurance clause bounding in time what counts as a single loss, generally 72 or 168 hours depending on the peril.
March 2020: the tampered update of Orion, SolarWinds' monitoring software, starts reaching its customers, and the intrusion only becomes public in December. The hours clause sets the window within which multiple losses are grouped into a single occurrence, seventy-two hours for a hurricane, one hundred and sixty-eight for other perils. It makes sense because a hurricane has a beginning, an end and a name. It turns absurd for a software compromise planted one day, dormant for months, then activated in waves, where nobody can say what day the event actually happened.
Since the first cyber catastrophe bond, placed privately in early 2023, and the first 144A issue in January 2024, these bonds have been written on a per-occurrence basis, applying a notion of occurrence, and thus an hours clause, to a peril that has no natural one.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.