Launching an affirmative cyber product with silent cyber exposure

Forty claims are not credible for a heavy-tailed cyber book. The mean of £120,000 and the largest claim of £8m suggest a skewed distribution, but the legacy book was not representative of SMEs, so the data cannot be used as a simple base. The largest claim may be a single event that would dominate any standard frequency-severity fit. A better approach is exposure-based pricing: segment SMEs by revenue band, sector, limit purchased, security controls and business interruption dependency. Use the legacy data as a weak prior, credibility-weight it with external market data and vendor benchmarks, and load explicitly for model uncertainty. Price separately for affirmative cyber and for silent cyber, because the latter is an accumulation risk embedded in property and liability wordings. Set minimum deductibles, sublimits for data restoration and business interruption, and clear exclusions for systemic events. Test the price against several scenarios, including a cloud-provider outage and a widespread ransomware event, and document the assumptions. The pricing should also include a margin for capital and for the cost of reinsurance.

Aggregation risk arises because many policies can attach to the same event: a cloud provider, a software vulnerability, a payment processor, or a common policy wording. The insurer should first map silent cyber exposure by policy type, wording and limit, and estimate how much of the property and liability book could respond to a cyber event. It should then build scenarios: a cloud outage causing business interruption across many SME policyholders, a ransomware event affecting a common software vendor, and a data breach affecting a shared service provider. For each scenario, estimate the gross loss, reinsurance recovery and net loss. The risk appetite statement should set explicit limits, such as a maximum aggregate limit per cloud provider, a maximum portfolio loss for a 1-in-100 cyber event, and a cap on silent cyber exposure as a percentage of capital. Controls include affirmative cyber wording, silent cyber exclusions where permitted, accumulation monitoring, and underwriting referral for large limits. The insurer should also stress the scenario where a common exclusion is challenged or a court interprets a policy more broadly than intended.

The 40% quota share reduces frequency and severity on individual policies, but it does not necessarily control aggregation. The aggregate stop loss of £30m excess of £20m may help, but its trigger and scope matter: if it covers all lines, it could be eroded by property or liability losses before a cyber event occurs. The insurer should check whether the stop loss is cyber-specific, whether it responds to a defined event, and whether it reinstates after a large loss. A 40% quota share plus a broad aggregate stop loss may still leave the insurer exposed to a systemic cloud outage that hits thousands of SMEs at once. I would recommend a cyber-specific catastrophe excess of loss layer, or a dedicated aggregate stop loss, alongside the quota share. The retention should be set so that a 1-in-100 cyber scenario does not threaten the risk appetite. The insurer should also consider whether the reinsurer has cyber expertise and whether the wording covers silent cyber. Before launch, test the structure against the cloud-outage scenario and confirm that recoveries are not undermined by event-definition disputes.