Cyber catastrophe scenario
An extreme but plausible cyber event, described in detail, used to measure what a portfolio would lose in an accumulation, for want of enough history for a purely statistical approach.
For lack of sufficient history of cyber catastrophes, insurers and regulators measure accumulation through scenarios: extreme but plausible events, described in their mechanism, spread and duration, whose effect on a given portfolio is computed. The classic families are a prolonged outage at a major cloud provider, ransomware spreading through a common vulnerability, an attack on energy or financial infrastructure, compromise of ubiquitous software and a massive data leak at a shared provider. For each, one must state which companies are hit, for how long, which covers respond and which are excluded, notably by war and infrastructure clauses. A scenario has a virtue a probabilistic model lacks: it can be debated, since each assumption can be challenged. It also has a limit: its probability is a convention, and the choice of scenario, often inspired by an event that already happened, leaves out the catastrophe nobody imagined. Market authorities require insurers to report their exposure to reference scenarios.
In 2015, a scenario published by Lloyd's with the University of Cambridge described an attack on the power grid of the northeastern United States leaving 93 million people without electricity, at an estimated economic cost of 243 billion to more than 1 trillion dollars. In 2019, another global ransomware scenario put economic losses at 85 to 193 billion dollars.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.