Cyber Aggregation and Risk Appetite Breach

The risk appetite limit is 25% of $400M surplus, or $100M. The scenario produces $120M net after reinsurance, so it breaches the limit by $20M, or 5 percentage points of surplus. The aggregation mechanism is common-mode dependence: thousands of insureds rely on the same cloud-service provider, so a provider outage can trigger correlated contingent business interruption and liability claims across many policies at once. Per-risk reinsurance of $30M xs $10M does not protect most of the book because the average limit is $5M, which sits below the $10M retention. The 60% quota share on the first $10M helps, but 40% of those losses remain net, and limits above $10M are only partly covered by the per-risk layer. The top 20 insureds already represent $420M of aggregate limit, which is more than surplus, and the scenario shows that correlated limits can exhaust reinsurance. The CRO is correct that the structure addresses individual risk, not accumulation. This is an ERM issue because it is a concentration risk, not a frequency risk.

The cat bond covers $75M xs $100M. On the $120M net scenario, it would pay $20M, reducing the net loss to $100M, exactly at the 25% risk appetite limit but with no buffer. The annual cost is $8M, or 2% of surplus, and the bond is fully collateralized, which reduces counterparty credit risk but ties up capital and may limit flexibility. The cat bond does not reduce the frequency of accumulation events; it transfers tail severity. For a 20% growth plan, the gross scenario would rise to about $216M and, if reinsurance terms are unchanged, net could rise to about $144M. The cat bond would pay $44M, leaving $100M net, again exactly at the limit, assuming the bond limit is not eroded. That is not sufficient because a larger or second event could breach the appetite. Alternatives include an aggregate stop-loss, per-provider sublimits, reduced concentration in the top 20 insureds, and a growth pause until accumulation controls are in place. The cat bond is useful as a tail layer but should not be the only mitigation.

I would recommend a package rather than a single solution. First, impose per-cloud-provider aggregate limits and a concentration limit by provider, region, and service; the current top 20 aggregate limit of $420M is too large relative to $400M surplus. Second, buy an aggregate cyber stop-loss or aggregate retro cover that attaches below the cat bond, and require the cat bond if the board wants tail protection. Third, stress-test a 20% growth scenario before approving growth and cap growth until the net single-event loss is below 15% of surplus with a buffer. Fourth, improve data collection on provider dependencies, silent cyber, and contingent business interruption. Fifth, update the risk appetite statement to include explicit cyber sublimits: a single-event net loss limit, a provider concentration limit, and a growth condition tied to reinsurance capacity. The cat bond can be approved only as part of a layered program, not as a substitute for underwriting controls.