- Property & Casualty
- Life & Health
- Knowledge Center
-
About Us
About Us OverviewCorporate Information
TOP
Have you ever wondered why your friends have more friends than you do? On average, they do – and it is not about popularity. The fact holds for the majority of us, which is what makes it a paradox.
What applies to individuals and their highly connected friends applies to businesses and their service providers. The providers a business relies on are, on average, those that many others rely on too – so its providers are more connected than the business itself. For an insurer, that fact bears on a familiar question: whether a larger book of business – the portfolio of insured risks – diversifies the risk it carries, or concentrates it.
Insurance rests on pooling. An insurer holds many risks together, so that the few who suffer a loss are covered by the many who do not. When those risks are independent – when one loss says little about whether another will occur – holding more of them makes the average loss per risk more predictable, and the swing around that average narrows as the pool grows. This is the law of large numbers, and it is the actuarial basis of pooling: for an insurer, size is ordinarily a source of safety.
Artificial intelligence and cyber strain that basis. Concentration of risk in a book of insured businesses originates not so much in the businesses themselves as in the providers they share. Because these providers are common across the economy, the losses an insurer holds grow more correlated: a failure at one widely used platform can produce losses at many policyholders simultaneously.
The trigger need not be malicious. In July 2024, a defective update from CrowdStrike, a security platform that many organizations run, sent an estimated 8.5 million Windows machines into the blue screen of death within hours, disrupting airlines, banks, and hospitals worldwide.1 The event was not a cyberattack – the update was a faulty configuration file – yet shared dependence on a single platform turned one defect into economic losses at many organizations at once.
That shared dependence runs counter to a condition long treated as basic to insurability, and it does so through a property inherent to networks.
The study of insurability gives this idea a formal place. Baruch Berliner’s framework sets out the conditions under which a risk lends itself to private insurance, and among them is that individual losses be, to a sufficient degree, independent of one another – that they not all fail together.2
Cyber risk has been examined against these conditions directly. Biener, Eling, and Wirfs assessed cyber against Berliner’s criteria and identified the independence of losses, together with the potential for accumulation – many claims stemming from a single event – among the conditions it strains.3 A later review by Eling and Schnell arrived at a similar view.4 These studies identify where the difficulty lies; they do not resolve whether it can be overcome.
The mechanism has a name: the friendship paradox, described by the sociologist Scott Feld in 1991.5
The graphic below shows the paradox in a small friendship network.
Feld’s friendship paradox – your friends have more friends than you do – in a small friendship network. Each circle is a person and each line a friendship; the number in a circle is that person’s count of friends. The table counts, for each person, their friends and their friends of friends. Averaged over the eight people, each has 2.75 friends (22/8); averaged over the 22 ends of the network’s 11 friendships – each tie counted from both sides – a friend has 3.45 (76/22). The average person has fewer friends than the average person’s friends do. Recreated from The Reliants Project.
A well-connected person is named as a friend by many others; a poorly connected one, by few. A friend picked at random is therefore more likely to be well connected than not, because each well-connected person is counted once for every friend who names them. The average number of friends is higher when taken over friends than when taken over people.
The paradox is not confined to friendships. It holds in any network where connections are uneven.
The businesses an insurer covers – its policyholders – form a network of this kind with their providers. A business uses hundreds or thousands of vendors, but the cloud services, AI foundation models, and cybersecurity suites it relies on come from only a handful, shared with most other businesses – which makes those few the hubs. The friendship paradox reappears, with “provider” in place of “friend.”
Consider a constructed case. A mid-sized healthcare provider applies for cyber insurance. Its external footprint is small: an electronic-health-record database serving a niche specialty, and an AI middleware service that converts clinical notes into billing codes. Two integrations; on a local review – access controls, patch discipline, backup practice – the risk looks contained. The graphic below draws the case one step out.
The friendship paradox, one step out from a single applicant: a constructed case. The blue circle at the left is the applicant, a mid-sized healthcare provider; the amber circles are its two providers – an electronic-health-record database with two connections, and an AI middleware service integrated by 5,000 organizations, of which a representative few are drawn. Light gray circles are other organizations; the blue circles among the hub’s spokes are other policyholders of the same insurer’s book. The applicant and its two providers are drawn larger for legibility; circle size carries no meaning. The panel at the right gives the two counts of the friendship paradox: the applicant’s own integrations, 2, and the average across its two service providers, (2 + 5,000)/2 = 2,501. The network is constructed for illustration and carries no empirical data. Source: Gen Re.
The paradox enters through the second integration. In the construction, the records database serves one other organization, so it carries two connections, while the middleware service – useful and inexpensive – is integrated by 5,000 hospitals, billing companies, and health-technology platforms, of which the figure draws a representative few. The applicant’s own count of integrations is two; the average count among its two service providers is (2 + 5,000)/2 = 2,501. The applicant that looks nearly isolated is attached, at one remove, to one of the most connected nodes in its industry. And the friendship paradox says this is the expected case, not the unlucky one: a provider picked at random is more likely to be a hub because hubs establish and retain many connections.
Now let one flaw in the middleware service’s data-ingestion pipeline be exploited – or fail on its own. There is one point to attack or to break, not 5,000, and in the same hour the disruption reaches every organization whose records pass through the service, this applicant among them. Some of those organizations are policyholders of the same insurer – the blue circles among the hub’s spokes in the graphic – so what arrives is not one claim but many, together. For the insurer, the lesson concerns the book more than the applicant: many policyholders, each with a short and reassuring list of integrations, share the same hub, and a local review of each policyholder, taken alone, understates how correlated the book’s losses are. The exposure that matters sits one step beyond the application form, in the dependencies the form does not ask about.
What matters for insurance is that this concentration does not dissolve as the book grows. Writing more policies brings more policyholders into the book, but those policyholders depend on the same few vendors – so the book can hold a great many distinct policyholders and still rest on that short list, common to a large share of the policyholders.
The insurer’s exposure to these providers is indirect. It does not contract with them; it underwrites the businesses that do and takes on their shared dependence through the book. Because that exposure reaches the insurer only through the policyholders, it appears less in any single risk the insurer writes than in the book as a whole.
This is where diversification meets its limit. Pooling makes a book less risky when its risks are independent, and less so as shared dependence correlates them: a larger book then adds little diversification. What this concentration reduces is the safety size normally brings, more than it changes how often losses occur or how large the average loss is.
None of this decides, by itself, whether a given exposure should be written, at what price, or on what terms. It records a feature of the structure: a book can grow larger without becoming more diversified. And what that feature asks of underwriting sits at the level of the book: the providers, platforms, and dependencies policyholders share are as informative as the controls of any single applicant.
Next in the series: “Risk You Can Price, Uncertainty You Cannot” – Knight’s distinction and the AI and cyber tails.
