Definitions
Terms used in this paper
These definitions establish how the paper uses its core terms before the argument begins.
- Systemic cyber event
- A defined cyber or technology event capable of affecting many organizations through shared dependencies or correlated conditions.
- Scenario assumption
- A modeled condition such as outage duration, propagation, policy response, or recovery behavior that is distinct from observed portfolio facts.
- Resilience evidence
- Evidence about recovery, segmentation, contingency, or other capabilities that may affect loss severity under a scenario.
- Accumulation
- Correlated exposure and potential loss across multiple insureds, policies, carriers, or treaties.
1. Systemic does not mean uniform
A major technology event can affect thousands of organizations while producing very different operational and insured outcomes. Duration, dependency depth, segmentation, recovery capability, business model, and policy terms shape the eventual loss.
Reinsurance scenario design should therefore avoid a binary exposed/not-exposed assumption where richer evidence is available. Shared dependency identifies the potential correlation path; operational state helps describe how that path may translate into interruption or compromise.
2. Scenario evidence should separate observed facts from assumptions
Some scenario inputs can be observed directly, such as known provider use or current recovery evidence. Others are model assumptions, such as outage duration, attacker propagation, policy response, and take-up of contingency measures.
Keeping those categories separate makes stress tests easier to challenge. An accumulation team can change the scenario assumption without rewriting the factual inventory, and it can see where unknown dependencies limit confidence.
- Observed inputs
- Known provider use, dependency relationships, control state, and tested recovery evidence.
- Scenario assumptions
- Event definition, duration, propagation, policy response, and use of contingency measures.
Shared exposure does not imply equal loss. Keep factual inventory distinct from assumptions that can be varied in the stress test.
4. Scenario libraries should evolve with the dependency map
Digital concentration changes as insureds migrate platforms, adopt new providers, and consolidate technology. A scenario library created several years ago can become less representative even if the modeling methodology is unchanged.
Reinsurers should periodically compare their scenarios with observed portfolio dependencies and external threat developments. New concentration may justify a new stress test; reduced concentration may change the relative importance of an older one.
5. Better scenarios support treaty and capital conversations
Scenario analysis informs more than underwriting. It can support accumulation limits, cedant discussions, capital planning, wording review, and portfolio steering. The quality of those conversations improves when participants can inspect the dependency and resilience assumptions behind the modeled event.
The objective is not to claim that operational telemetry solves systemic cyber modeling. It is to connect the model to a more current and explainable view of the underlying digital system.
Evidence base
Sources and notes
External foundations are kept distinct from VitalSec implementation notes so readers can see what supports the argument independently and what documents the platform implementation.
External foundations and sources
VitalSec implementation notes
These links document how the argument is implemented or described inside VitalSec. They are not offered as independent validation of the paper's thesis.