Transfer · Problem-solving Use-Case

Price industrial cyber cover on modelled loss.

One run gives you the loss, a premium indication and a programme structure. The loss model is built for cyber-physical risk.

Your first result is a DeRISK™ UWA short report on one submission, with the headline loss figures. Professional adds the full actuarial output, and Enterprise can run your own model.

What you face

We are asked to price industrial cyber on models built for IT.

Pricing needs a frequency and a severity. A questionnaire gives neither.

85%
Cyber loss hides in property.NotPetya’s insured loss was put above US$3 billion. About 85% of it came through property policies that did not affirmatively cover cyber.1PCS (Verisk), “Could NotPetya’s Tail Be Growing?”
US$15.6–33.4 billion
Models disagree on the tail.When three leading catastrophe models were run on one industry exposure set, the modelled 1-in-200 loss ranged from US$15.6 billion to US$33.4 billion.2Guy Carpenter, Through the Looking Glass, 2023
7 of 100+
Few events, thin data.One modeller counted more than 100 cyber events with catastrophe potential in six years. Only seven became insurance events, and one, NotPetya, became a major one.3CyberCube, Cyber Attack Event Analysis, 2023
Models learned from IT losses.Most cyber models were calibrated on IT breach losses. The physical side of an industrial loss sits outside them.
A score is not a frequency.A maturity score says how good the controls look. It cannot be priced, because it says nothing about how often a loss happens.
The tail goes unseen.Limits and programme structure get set without a view of the tail, so the largest losses are the least understood.
How DeRISK solves it

From the submission to a priced programme.

One run gives the loss distribution, what drives it and a programme to match. The actuary can check every input and assumption.

Model the loss

Get expected annual loss, value at risk, occurrence and aggregate exceedance (OEP and AEP) and tail value at risk. They come from a Monte Carlo engine built for cyber-physical loss, or from your own model.

Loss outputs

Example submission. Expected annual loss, the 1-in-100 year total and the maximum foreseeable loss.

See what drives it

Split the expected loss by threat type, with how often each happens (frequency) and how large it gets (magnitude). Ransomware that reaches OT and cyber-physical equipment damage show up as lines of their own.

Share of expected annual loss

Example submission. Each threat’s share of the expected annual loss.

Structure the programme

Get a premium indication and a recommended programme, with limits and sublimits by coverage line. The underwriter adjusts it, and nothing binds without a person.

Recommended programme: limits and sublimits

From the sample programme structuring report.

What you get

From the sample programme structuring report: how each control gap adds to the premium. Beside it, the method and assumptions every output carries.

Programme structuring: risk adjustment by control gap

Method and assumptions

A number you can rely on

The method, written down

Simulation method, parameters, calibration data and assumptions, in the report.

A human reviews every output

Nothing reaches pricing without a person, and every run keeps its audit trail.

Your own actuarial model, on Enterprise

The Enterprise tier substitutes your actuarial model entirely.

Submissions stay private

Each runs in isolation, nothing trains the models, and client data is flushed after the run.

Where to start

Start free. Go further when pricing needs it.

Standard is free: one submission and a short report with the headline loss figures. Professional is recommended for the full actuarial view. Enterprise runs your own actuarial model in place of ours.

Free
Standard
Where you start

You add

  • One submission document, in a pre-trained questionnaire format

You get

  • A short report from the standard actuarial engine, on NIST CSF and IEC 62443-inspired frameworks
Premium
Professional
Most teams

You add

  • Multiple documents and custom submission types

You get

  • Committee-ready reports, white-labeled and saved, on your own insurer framework
  • Add-ons start here
Enterprise
At scale

You add

  • API access and a single-tenant option

You get

  • Your own actuarial model in place of ours, and your own report
Add-ons
From Professional

Choose

  • DeRISK Davy, DeRISK Consultant and DeRISK Scenario Simulator

Keep going

Sources

  1. 1.PCS (Property Claim Services). “Could NotPetya’s Tail Be Growing?” PCS Global Cyber, Verisk, July 2019, verisk.com.
  2. 2.Guy Carpenter. Through the Looking Glass: Interrogating the Key Numbers Behind Today’s Cyber Market. Guy Carpenter, May 2023, guycarp.com.
  3. 3.CyberCube. Cyber Attack Event Analysis: Reflecting Trends in CyberCube’s Portfolio Manager Version 5. CyberCube, June 2023.

Price your next industrial risk on modelled loss.

Standard is free and assesses one submission with a short report. Professional adds the full actuarial output, committee-ready reports and saved analyses. Enterprise runs your own model.

The applicant is asked nothing. A person signs off every price.