The insurance industry faces significant challenges in managing systemic cyber risks. CyberCube, a firm specializing in cyber risk analytics, and Munich Re, a global reinsurance company, have made strides in addressing these challenges through a joint study on systemic cyber risks and the release of Portfolio Manager Version 6 (PMv6).
These developments mark a pivotal moment for the cyber insurance market, offering insights and tools to navigate a complex threat environment.
The joint study by CyberCube and Munich Re, released recently, provides critical insights into systemic cyber risks, drawing from the expertise of 93 cybersecurity professionals.
The report highlights two credible large-scale scenarios: widespread malware incidents and severe cloud service outages.
According to the findings, a severe malware event could infect up to 25% of global systems, though only 15% would likely be fully compromised.
Industry professionals agree that an event on the scale of WannaCry or NotPetya, while significant, would not be surprising, but they do not anticipate a scenario where over 50% of systems are completely compromised.
The study also identifies multi-region architecture as the most effective defense against cloud outages, dismissing the feasibility of switching cloud service providers during an incident.
Additionally, emerging technologies like Industrial and Consumer Internet of Things (IoT) devices are flagged as immediate concerns, with Large Language Models (LLMs) impacting the threat landscape and Artificial General Intelligence (AGI) posing a longer-term risk.
Jon Laux, Vice President of Analytics at CyberCube, emphasized the study’s goal:
“By sharing the findings of our study on systemic cyber risks, we aim to provide a more nuanced view of how systemic cyber events might unfold and the factors that drive wide variation in risk exposure across firms.”
These insights directly inform the enhancements in CyberCube’s Portfolio Manager Version 6.
PMv6 is a catastrophe modeling platform used by 75% of the top 40 US and European cyber insurance carriers, reflecting its critical role in the industry.
The latest version addresses the global expansion of the cyber insurance market, moving beyond its US-centric focus to include modeling capabilities for international exposures.
It incorporates geographic variations in cloud service provider outages and differences in the origin and spread patterns of ransomware and wiper malware attacks.
A key advancement in PMv6 is its emphasis on mitigation, recognizing the importance of protective measures in reducing the impact of large-scale cyber events—an area previously underexplored compared to resilience against attritional losses.
The release leverages companies’ security scores and introduces new risk modifiers aligned with NIST and CIS security control frameworks, enabling precise underwriting and exposure management.
Ashwin Kashyap, CyberCube’s Co-founder and Chief Product Officer:
“PMv6 represents a step forward for cyber catastrophe modeling. We have made progress in addressing the drivers of diversification and risk mitigation for the benefit of the cyber insurance market.”
The collaboration between CyberCube and Munich Re underscores a broader industry effort to model cyber accumulation risks.
The study’s findings have been integrated into PMv6 and Munich Re’s internal models, enhancing their ability to quantify systemic risks.
This is the third such study, with plans for another in 2026, inviting further participation from cybersecurity professionals to encourage ongoing dialogue.
The report also highlights the concentrated nature of the cyber insurance market in the US, where American technologies and data centers often serve as Single Points of Failure (SPoFs) globally, emphasizing the need for diversification as the market expands into regions like Europe and Asia.
CyberCube’s PMv6 also builds on its role in cyber catastrophe bonds, having supported deals like Beazley’s 2023 bond.
By combining data-driven analytics with AI and key insights, CyberCube and Munich Re are equipping insurers to make informed decisions in a dynamic threat environment.
These advancements aim to strengthen risk management and pave the way for sustainable growth in the global cyber insurance market.