/ Updated / 11 min read
Analytics team - Global RE Risk Science
Key takeaways
- Cyber severity is driven by shared dependencies such as cloud regions, managed service providers and payment systems.
- Where dependency data is thin, exposure is stress-tested rather than assumed to be diversified.
- Named supplier limits and precise event definitions improve the underwriting view; broad dependent BI wording does the opposite.
Why aggregation is the first question
Cyber severity is rarely driven by one insured. The larger concern is a shared dependency that can create losses across hundreds or thousands of policies at the same time.
Global RE reviews cloud regions, managed service providers, payment infrastructure, and identity platforms as accumulation points before considering price or line size.
How the exposure view is built
The analysis starts with declared technology dependencies and is then cross-checked against industry concentration assumptions. Where data is thin, the exposure is stress-tested rather than treated as diversified by default.
Scenario work considers outage duration, contractual notification duties, business interruption waiting periods, liability triggers, and whether one event can activate more than one coverage part.
What changes the underwriting answer
Strong segmentation, named supplier limits, precise event definitions, and transparent cedant controls can all improve the underwriting view. Broad dependent-business-interruption language without dependency data usually has the opposite effect.
The result is an appetite decision that reflects probable accumulation, not only the expected loss on an individual account.
Frequently asked questions
- What is systemic cyber risk?
- Systemic cyber risk is the chance that one event, such as a cloud region outage or a compromised shared platform, causes losses across many insureds at the same time.
- How do reinsurers model cyber aggregation?
- By mapping declared technology dependencies, cross-checking them against industry concentration assumptions, and running scenarios for outage duration, business interruption waiting periods and liability triggers.
