Tail correlation
Risks that look uncorrelated in normal conditions see their correlation converge toward one during extreme events. The diversification benefit vanishes precisely when it is most needed.
David Li publishes "On Default Correlation: A Copula Function Approach" in the Journal of Fixed Income in 2000, and the Gaussian copula becomes the market tool for pricing CDOs. Its flaw, which the 2008 crisis made visible, comes down to one number: its tail dependence is zero. Tail correlation, or tail dependence, describes variables weakly linked in normal conditions (linear correlation close to zero) and strongly linked in extreme scenarios. Formally, upper tail dependence between two risks X and Y is the limit of the probability that Y exceeds its extreme quantile given that X exceeds its own. The Gaussian copula sets it to zero, which makes extremes asymptotically independent. Student and Archimedean copulas (Gumbel, Clayton), by contrast, give positive tail dependence. In 2008, CDO tranches priced under a Gaussian assumption met real estate defaults far more linked in the tail than the model allowed. In cyber, a portfolio's tail dependence can approach one. On July 19, 2024, the CrowdStrike outage hit, at the same moment, the clients whose Windows machines received the same update, whatever the apparent decorrelation of their activities in normal times. The Solvency II standard formula aggregates through a correlation matrix and captures only linear dependence. It then overstates the diversification benefit it grants to cyber risk, to the point of making it illusory.
Textbook case. A portfolio of 1,000 SME policyholders of a cyber insurer appears well diversified: they operate in different sectors (retail, healthcare, manufacturing) and different countries. In normal conditions, the linear correlation of their losses is low. But 800 of them use the same endpoint security tool. In a CrowdStrike scenario, the effective tail correlation is close to one for these 800 entities: the single event triggers all their losses at once. Capital calculated on a moderate correlation assumption is massively insufficient.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.