TOP
A spark in a thinly wooded stand burns a few trees and dies; the same spark in a dense forest can run for miles. What changed is not the spark but the spacing – whether each burning tree, on average, ignites more than one other. Networks of shared dependence turn on the same threshold, and it decides whether one failure stays local or reaches most of the book at once.
Pooling assumes that a single event touches only a bounded part of the book – the insurer’s portfolio of insured risks. A fire, a motor accident, a storm of ordinary size – each affects some policyholders and leaves the rest untouched, so the loss from any one event is a fraction of the whole. The study of insurability makes this assumption a condition: the maximum possible loss from a single event – the most a single event can cost across the book – should be limited.
Artificial intelligence and cyber test that condition through shared dependence. When many policyholders rely on the same provider, one failure can reach a large part of the book at the same time. What matters is that the reach does not grow smoothly as dependence rises: it has a threshold.
Baruch Berliner’s framework limits the maximum possible loss from a single event and, closely related, the potential for losses to accumulate across the book.1 A line in which one event can reach much of the portfolio at once sits in tension with both.
Biener, Eling, and Wirfs count the accumulation potential of cyber risk – its capacity to produce many correlated losses from a common cause – among the properties that distinguish it from the established lines of insurance.2 The mechanism behind that accumulation is taken up next.
Networks give the structure a precise form. Consider a set of policyholders, connected when they depend on the same provider. As the density of shared dependence rises, the connected groups grow – but not evenly, and the change from small separate groups to a single network-spanning cluster is abrupt rather than gradual. The turn comes when each failure reaches, on average, more than one further policyholder.
This is the percolation threshold, studied in the mathematics of random networks.3 The same abrupt onset holds for networks with the uneven connectivity of real systems: below the threshold the network is a scatter of small pieces; a little past it, a single giant component appears.4 The quantity that jumps is the size of the largest group that a single failure can take down together.
This graphic puts the transition in insurance terms: on the vertical axis, the share of the book a single provider’s failure can reach; on the horizontal axis, the degree of shared dependence among policyholders.
The percolation threshold – shared dependence has a tipping point – in an illustrative view. In the upper panel the horizontal axis is the degree of shared dependence among policyholders, and the vertical axis is the share of the book reachable by a single provider’s failure; the curve is near zero below the threshold (dashed line) and rises steeply above it. The three lower panels are networks of 30 policyholders, joined where they share a provider; the amber cluster is the group a single failure takes down together, and its size is stated beneath each panel: 10% below the threshold, 43% at it, and 100% above it. The panels carry no empirical data and are constructed to illustrate the transition. Source: Gen Re.
The shape of the curve maps directly onto a book of risks. Below the threshold, losses stay local, and pooling does its ordinary work: adding policyholders reduces the relative variability of the loss. Above the threshold, the same event becomes many losses arriving together, and adding policyholders no longer reduces it, because the new policyholders sit inside the same connected cluster.
The graphic above is drawn on a network no insurer observes directly. In practice, the measurement runs through the accumulation model: the insurer estimates the net loss a single common trigger would produce across the book – for named scenarios and across return periods – and reads its position from how steeply that modeled loss rises as the trigger reaches more of the shared infrastructure. The steep segment in the graphic appears in that measurement as the range over which the modeled loss from one trigger stops being bounded by any single policyholder.
One market participant’s investor update of October 2024 on its cyber book makes such a measurement public.5 The update defines systemic risk as cyber losses arising from a common cause, malicious or non-malicious; names business interruption as a key driver; and lists as prior systemic events the CrowdStrike outage – a non-malicious software failure that produced losses under cyber policies – and the Change Healthcare cyberattack, both of 2024. Its realistic disaster scenarios are built on the failure of a data aggregator, a shared hardware or software platform, or a cloud provider – the common providers whose failure defines the clusters as shown in the graphic – and are sized below the 1‑in‑250 point of the probabilistic model. That 1‑in‑250 net modeled loss stood at $461 million in October 2024, down from $651 million at 31 December 2023.
Scale comes from the participant’s annual disclosures: cyber insurance written premiums of $1,184.3 million in 2023, and total shareholders’ equity of $3,882.1 million at 31 December 2023.6 Against equity, the modeled tail is contained: $651 million is about 17% of year-end 2023 equity, and $461 million about 12%. The limits behind the book are of a different order. Under the assumptions of the pool inference, total limits deployed run on the order of $118 billion to $150 billion – roughly 31 to 39 times shareholders’ equity. The modeled tail therefore asserts that, of limits amounting to more than 30 times equity, a 1‑in‑250 event reaches about one-eighth to one-sixth of equity; the distance between those two magnitudes is bridged by the model’s assumptions, not by a loss record.
The update reports the decline in the modeled tail alongside measures of two kinds. On the underwriting side sit the levers that lower the reach of a single trigger: a line-size ceiling, with 99% of policies at $10 million or less; sub-limits on contingent business interruption; waiting periods; and exclusions for war, cyber war, and infrastructure. In reading the graphic, these act on the degree of shared dependence a single failure can exploit. On the financing side sits catastrophe protection of $1 billion: catastrophe bonds carrying $510 million of limit in layers running from a $500 million attachment to a $1,200 million exhaustion; an industry loss warranty of $290 million, providing cover when the industry loss exceeds $9 billion; and $200 million of traditional reinsurance.
Protection of this kind does not lower shared dependence – it transfers the tail – and the third bond layer was placed in September 2024, so part of the decline in the net figure reflects added protection rather than a change in the book.
The market participant also disclosed the natural-catastrophe counterpart: a risk appetite for the probabilistic 1‑in‑250 U.S. natural-catastrophe event of $438.0 million for 2022 – a ceiling on the modeled net exposure, and about 15% of that year-end’s shareholders’ equity.7 This graphic places the disclosures on one scale, as shares of equity.
One market participant’s disclosed tails, as shares of shareholders’ equity. In the left panel, the horizontal axis is the disclosed figure as a percent of shareholders’ equity: the two deep blue bars are the cyber book’s probabilistic 1‑in‑250 net modeled loss – $651 million at 31 December 2023 against year-end 2023 equity of $3,882.1 million (about 17%), and $461 million at October 2024 against the same year-end 2023 equity (about 12%) – and the green bar is the natural-catastrophe risk appetite for a probabilistic 1‑in‑250 U.S. event, $438.0 million for 2022 against year-end 2022 equity of $2,955.0 million (about 15%); the appetite is a ceiling on modeled net exposure rather than a modeled loss. In the right panel, drawn on its own scale, in multiples of shareholders’ equity, the bar spans the total cyber limits deployed as inferred in the notes – $118.4 billion to $150.0 billion, or about 31 to 39 times shareholders’ equity – with the span reflecting the assumed average premium of $15,000 to $19,000. Dates and denominators differ across bars as stated; all values are disclosures or inferences from disclosures, not observed losses. Sources: the participant’s investor update of October 2024, Solvency and Financial Condition Report 2023, and Annual Reports 2022 and 2023, as cited in the notes.
Looking at the graphic, the likeness in the left panel is the point of caution. As shares of equity, the modeled cyber tail and the modeled natural-catastrophe tail sit side by side, between about one-eighth and one-sixth of equity – and on the page, the two figures carry the same precision. What stands behind them differs in kind. Behind the natural-catastrophe figure lie decades of recorded losses and models grounded in the physics of windstorm and earthquake; wildfire stands apart. Behind the cyber figure lies no comparable record: the modeled loss is what remains of limits amounting to more than 30 times equity after the model’s assumptions about how little of them one event reaches – assumptions the right panel shows to be carrying almost the entire distance. For windstorm and earthquake, the modeled 1‑in‑250 has earned the reliance placed on it; for cyber – as for war and terrorism – it has not yet; and the market’s scenario regimes do not draw the distinction: Lloyd’s realistic disaster scenarios request a modeled loss for windstorm and earthquake, and for cyber and terrorism, in the same form.8 Neither the participant nor the market presents these disclosures in the language of percolation; that reading is this post’s. The figures are model outputs, not observed losses – and for cyber, that is precisely the caution.
Above the threshold, the exposure changes in kind, not degree: it is rare, large when it arrives, and correlated across the book. It does not behave like the diversified remainder, where the law of large numbers holds; capital standing behind it bears a risk closer to that of equity than of a pooled book.
The cyber market has built a response into the wording. Under a widespread-event endorsement, an incident is sorted into one of two kinds – a limited-impact event or a widespread event – the latter defined by a common trigger such as a severe shared vulnerability, a software-supply-chain compromise, or the failure of a system on which many policyholders depend.9 Losses from a widespread event are met by a separate, lower sub-limit, set apart from the overall policy limit, so a single event cannot reach the full book at full terms. That sub-limit is the accumulation condition written into the contract: it bounds how much of the book one event can cost – the quantity that the threshold, once crossed, leaves unbounded. Supervisors treat this accumulation as a major challenge of cyber underwriting, driven by shared dependence on cloud providers and software platforms through which a single failure can cascade across many policyholders.10
That response is still being extended, and along the same structural line. In August 2026 the Lloyd’s Market Association confirmed that it is considering a model infrastructure-failure exclusion for cyber policies, developed with its cyber business panel and, like its other model clauses, open to adaptation rather than mandated.11 What such a clause has to define is the set of dependencies whose failure carries the cluster: shared infrastructure on which many policyholders rest at once, where one event could generate claims from “thousands of insureds simultaneously.” Naming that set in the wording is the operation the sub-limit performs on the loss, moved one step earlier – it fixes in the contract what the threshold fixes in the structure. Reinsurers have meanwhile resisted broader critical-infrastructure cover through the soft market, on the account of two of them, so the threshold shows in what the market declines to write as much as in what the wording bounds.
Whether such exposure should be written, and how much of it to retain, the structure does not decide. It fixes something narrower: the point at which the maximum possible loss stops being bounded by the size of any single policyholder and comes to be set by shared dependence.
Next in the series: “Priced for the Worst” – the market for lemons and the retreat from AI cover. Missed the previous article? Read it here.
