Catastrophe risk modeling firm AIR Worldwide announced it has developed a probabilistic model for cyber risk, which is capable of accounting for security breach and cloud service provider downtime incidents for insurance portfolios worldwide.
AIR’s probabilistic cyber model estimates the likelihood, severity, and economic and insurance impact of security breach and cloud service provider downtime incidents. AIR said that cloud service provider downtime incidents are one of the most likely forms of aggregation risk for cyber.
The new AIR cyber model has been calibrated with public, commercial, and insurance claims data that includes information on more than 60,000 worldwide incidents and the cyber security profile of over 100,000 organizations globally, said AIR in a statement.
The new model will be included in the latest release of Analytics of Risk from Cyber (ARC), AIR’s cyber risk modeling and analytics platform, which is due for general release on Oct. 31, 2018.
“Many insurers are challenged to understand how often various types of cyber incidents can occur and how they can affect the performance of their book,” said Prashant Pai, vice president of cyber offerings at Verisk, the parent company of AIR Worldwide.
“As a result, decisions on product development, underwriting, portfolio optimization, and capital allocation tend to be made with limited data, and too much weight is often put on intuition or broad assumptions. This is where probabilistic modeling can help the industry better manage cyber risk globally,” Pai added.
“The detail and quality of the data we have has allowed us to apply innovative stochastic and machine learning techniques to create a model that provides granular output,” said Scott Stransky, assistant vice president and director of emerging risk modeling at AIR.
“By training our machine learning model on real claims data, the model can differentiate the risk by technographic parameters such as cyber-security practices, cloud service provider, and the cause of cloud downtime incidents, in addition to firmographic characteristics such as company size and sector,” Stransky added.
“AIR’s philosophy is to be transparent and flexible about the various modeling assumptions we’ve made, and model users can dig into them and truly own the risk,” he said. “Additionally, we’ve collaborated with development partners to allow outputs to be displayed to our users at the organization level.”
“We’re excited to be both one of the first users of AIR’s new probabilistic cyber model and a part of the model’s development,” commented Ian Newman, partner and global head of cyber at reinsurance broker Capsicum Re. (AIR and Capsicum Re announced in September they are collaborating to enhance the insurance industry’s modeling of “silent” cyber incidents.)
“Making use of AIR’s cutting-edge model will help our current and prospective clients better understand their cyber exposure,” Newman noted.
“It will reinforce our ability to develop and deliver innovative cyber insurance solutions, such as cyber industry loss warranties (ILWs), and work with insurance-linked securities (ILS), Newman said. “We also believe analytics are key to the market of the future, which will consist of three core classes: property, casualty, and cyber.”
In addition to the probabilistic model, the latest version of ARC features functionality to help insurers understand their additional risk due to the EU’s General Data Protection Regulation (GDPR). AIR said the model also expands its cyber industry exposure database to regions globally.