Cyber event definition (reinsurance)
A clause in an excess of loss treaty that states when several cyber losses form a single event, by common cause, time window or attacker, on which the whole protection against accumulation depends.
A per-event excess of loss treaty responds only if the insurer's losses can be added together as a single event. For a hurricane, the question is settled by an hours clause and a geographic area. In cyber, neither bound works: malware spreads everywhere at once, a campaign can last weeks, and several groups can exploit the same flaw. The market has therefore built specific definitions combining three criteria. A common cause, for example exploitation of the same vulnerability or failure of the same provider. A time window, during which losses linked to that cause are aggregated, often from a few days to a few weeks depending on the type of event. And sometimes the identity of the attacker. Each choice shifts risk between insurer and reinsurer: a narrow definition fragments the accumulation into losses below the retention, a broad one makes the reinsurer pay for independent events. Consistency with direct policies is decisive, especially on the war exclusion, otherwise the insurer alone bears what it pays and its treaty excludes.
The July 19, 2024 outage caused by a faulty security software update raised the question in real time: did the business interruption losses of thousands of insureds form a single event under the treaties, when there was no attacker and no exploited vulnerability, but a single technical cause? The answer depended word for word on the definition chosen in each treaty.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.