Systemic cyber risk
Risk that a single cyber event simultaneously affects a large number of interconnected insureds, generating an accumulation of correlated claims that cannot be modeled with traditional actuarial tools.
On July 19, 2024, a faulty content update to CrowdStrike's Falcon sensor took down about 8.5 million Windows machines by Microsoft's count, from airport check-in desks to hospital emergency rooms. No attacker, one file. Systemic cyber risk is the possibility that a single cyber event triggers simultaneous, correlated claims from a very large number of insureds. The event may be a massive cyberattack, a widely exploited zero-day vulnerability or the failure of critical digital infrastructure (cloud provider, DNS, BGP). The resulting accumulation can exceed the insurance sector's capacity. This risk differs structurally from natural perils, where geographic correlation is predictable. The perimeter of a cyber event is hard to define ex ante, and it can spread almost instantly worldwide. State-backed cyber operations are a particularly worrying subcategory: their firepower and their ability to target critical infrastructure make them potentially more devastating than a cybercriminal attack. That is why Lloyd's demanded clarity on cyber war coverage: its Market Bulletin Y5381 of August 16, 2022 requires, at inception or renewal of any cyber policy from March 31, 2023, an exclusion for state-backed cyber-attacks. The model clauses that answer it are drafted by the Lloyd's Market Association. By excluding or capping the most systemic state-backed cyber operations (impacted state), the LMA 5565 to 5567 clauses aim to make the residual risk modelable, and therefore insurable.
On July 19, 2024, the CrowdStrike outage temporarily paralyzed 8.5 million Windows machines worldwide: hospitals, airports, banks. Parametrix put the direct loss for Fortune 500 companies alone, Microsoft excluded, at 5.4 billion dollars, and the insured share at 540 million to 1.08 billion, 10 to 20% of the damage, the rest sitting in retentions and policy limits. Although non-malicious, this outage illustrated the accumulation potential of systemic cyber risk. A state-backed cyberattack of the same scale would have triggered simultaneous claims at thousands of insureds.
- Lloyd's, Market Bulletin Y5381, "State backed cyber-attack exclusions", August 16, 2022; Parametrix, "CrowdStrike to cost Fortune 500 $5.4b; insured loss range of $0.54b to $1.08b", July 24, 2024
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.