Cyber catastrophe excess-of-loss protection, commonly referred to as Cyber Event XoL, has become an increasingly important tool for managing systemic cyber accumulation risk. As cyber portfolios grow and dependence on shared technology ecosystems deepens, insurers are seeking protection against losses capable of affecting large portions of their books simultaneously.

At the same time, cyber accumulation modeling and management have matured significantly. Insurers today assess concentrations related to cloud providers, software dependencies and service providers. Event definitions have evolved alongside this understanding and are reflecting the aggregation mechanisms of concern to the industry.

Yet, discussions around Cyber Event XoL often return to the question of basis risk. Because cyber risk continues to evolve rapidly, some market participants question whether there is a “basis risk” that future cyber catastrophes may emerge in ways that fall outside today’s event definitions. This concern is understandable, as any risk manager and reinsurance buyer needs to ensure that the cover is fit for purpose. What is the appropriate frame of reference for judging its purpose and value?

For catastrophe risk transfer, the critical issue is not whether we can predict the exact form of all future cyber events. It is whether the aggregation mechanisms most capable of producing balance-sheet-threatening losses are adequately reflected in the loss occurrence definition. Viewed through that lens, the focus is on understanding how these relevant losses accumulate, rather than on listing every possible but highly unlikely event type.

Unknown Events Do Not Imply Unknown Aggregation Pathways

One of the defining features of cyber risk is that major events frequently appear unprecedented. No market participants predicted the precise form of NotPetya, SolarWinds, Log4Shell, the cyber attack on Change Healthcare or the CrowdStrike outage before they occurred. Each emerged through a different combination of technology, timing and circumstance. Because of this, cyber is often described as a peril dominated by “unknown unknowns.”

However, while the events themselves were new, the mechanisms through which losses accumulated were far more familiar — not least because the industry’s understanding of cyber accumulation has improved significantly over the past decade. Today, there is broad market recognition that the most severe accumulation scenarios tend to arise from a relatively limited set of drivers:

• Exploitation of a common vulnerability
• Software supply-chain compromise
• Malicious or erroneous software updates
• Self-propagating malware
• Cloud outages and disruption of critical third-party service providers

The next cyber catastrophe will most likely look different from the last one. The relevant question from a risk transfer perspective is whether the pathways through which losses become systemic are adequately reflected in the event definition.

Event definitions have not evolved independently from cyber catastrophe modeling. Both have developed in response to the same fundamental question: How do cyber losses accumulate across portfolios? Earlier generations of cyber wordings often relied on concepts such as a single cyber event or named catastrophe trigger. Modern structures increasingly seek to address vulnerabilities, technology dependencies and other forms of systemic cyber accumulation more generically.

As a result, the gap between how accumulation risk is modeled and how it is reflected contractually is materially smaller than is sometimes assumed.

Catastrophe Markets Have Never Been Static

Catastrophe markets have always evolved through learning, adaptation and experience. Property catastrophe reinsurance provides a useful comparison. Occurrence definitions did not emerge fully formed. They evolved as the market’s understanding of hurricanes, earthquakes, wildfires and severe convective storms improved.

Cyber is undergoing a similar process. Earlier cyber event definitions often focused primarily on malicious activity and did not fully contemplate the accumulation potential of non-malicious technology failures. The CrowdStrike event accelerated market learning and contributed to broader recognition that both malicious and non-malicious pathways can generate systemic losses.

This learning from — and deriving insights beyond — a single event is evidence of a functioning and maturing market. Each major cyber event or modeling innovation improves the industry’s understanding of accumulation dynamics and helps refine contractual approaches to risk transfer.

The True Uncertainty: Will Event XoL Capture the Tail?

Much of the basis risk discussion implicitly assumes that the primary objective of Cyber Event XoL is to ensure coverage for every conceivable sequence of cyber losses. From what Munich Re sees, that is not generally why the cover is purchased.

Cyber Event XoL fundamentally serves as a tail-risk management tool. Its purpose is to protect earnings and capital against severe accumulation scenarios that could materially impact an insurer’s balance sheet. A scenario that, technically speaking, falls outside of an event definition may represent an interesting example of basis risk. However, if that scenario is unlikely to generate a balance sheet threatening loss, its practical significance is limited.

Conversely, the scenarios most capable of producing 1-in-100 or 1-in-200-year portfolio outcomes are typically driven by the above mentioned large-scale aggregation mechanisms. They have received the most attention from the cat modeling community, and these are precisely the scenarios that modern event definitions increasingly seek to address.

Table 1 Probability × Severity Matrix

From a combined probability and severity perspective, Table 1 provides a useful framework for the discussion. Outside of true black swan scenarios, much of the basis risk debate tends to focus on the lower-left quadrant of the matrix: low-probability scenarios that may technically fall outside an event definition but have limited loss potential. Catastrophe protection, however, is primarily concerned with the right-hand side of the matrix, where capital and earnings are genuinely at risk.

The relevant test is therefore not whether some hypothetical future loss can be imagined outside existing wording. It is rather whether the scenarios most capable of producing severe portfolio outcomes are captured. On that measure, the answer is increasingly yes, as today’s event definitions are designed to do precisely that.

What About Black Swans?

A legitimate question remains whether a future cyber catastrophe could emerge through an accumulation mechanism that is not contemplated by today’s models or event definitions. Such scenarios can never be ruled out. Cyber risk by nature continues to evolve. Artificial intelligence and quantum computing are reminders of the scale of change that can be expected in the future, so naturally, future forms of digital interdependency may emerge that will require us to rethink how we look at accumulation risk in an iterative process.

However, the existence of residual uncertainty is not unique to cyber. No catastrophe market operates without it. Property catastrophe protection is purchased despite the possibility of previously unobserved loss patterns. The risk mitigation provided by insurers, based on ever-improving expertise, plays a stabilizing and virtually irreplaceable role for every society in this regard as well.

The key question is therefore not whether black swan events exist. By definition, they do. The question is whether risk transfer meaningfully reduces exposure to the severe and plausible loss scenarios that can be identified today. Viewed through that lens, concern about black swans should not dominate the conversation around Cyber Event XoL. Rather, the focus should be whether the structure of the transfer solution truly captures the accumulation drivers most likely to threaten earnings and capital.

To enhance the effectiveness of their reinsurance structures, insurers often combine quota-share arrangements with catastrophe excess-of-loss protection. Quota shares participate across all losses irrespective of whether a specific event trigger is met, while Cyber Event XoL provides dedicated protection against severe accumulation scenarios. Combined, these structures can further reduce the economic relevance of unknown future loss manifestations while maintaining the benefits of dedicated catastrophe protection – benefits that broader structures, such as stop-loss treaties, may not always provide.

Beyond Basis Risk

Cyber risks will continue to surprise the market. New technologies, new dependencies and new vulnerabilities will emerge. Future cyber catastrophes will differ in detail from those observed today. However, these surprises do not mean that unknown events necessarily imply unknown aggregation pathways.

For Munich Re, the increasing alignment between cyber accumulation modeling, quantitative risk management and event definitions is one of the clearest indicators of the maturing of the cyber risk transfer market. Our objective in continuously investing in cyber expertise and insights is not to eliminate every conceivable source of uncertainty but to enable insurers to make informed risk, portfolio and capital management decisions while maintaining resilience against severe cyber accumulation events.

As technology evolves, so do cyber risks. We are actively working with industry partners to anticipate future cyber catastrophe scenarios and improve the market’s resilience.

While future cyber catastrophes may be difficult to predict in their exact form, the pathways through which systemic cyber losses accumulate are becoming increasingly well understood. Our current knowledge, combined with a prudent approach, provides the best foundation for Cyber Event XoL covers, ultimately enabling meaningful and sustainable transfer of cyber catastrophe risk.