Defining Cyber Catastrophes for Practical Application in the Insurance Sector.
A practical, insurer-focused definition of a cyber catastrophe — clarifying how large-scale cyber events develop, propagate, and accumulate losses.
This paper introduces a refreshed, insurer-focused definition of a cyber catastrophe, designed to support clarity, consistency, and effective risk transfer across the cyber insurance market. The objective is to contribute constructively to the industry-wide discussion and provide a foundation that helps insurers identify, model, and manage the most financially consequential cyber scenarios.
In shaping this definition, we examined how cyber incidents develop, the vulnerabilities and techniques involved, and the factors that drive widespread aggregation of loss. Our analysis of historical events highlighted a persistent challenge: the term "event" is interpreted differently by cybersecurity practitioners and insurance professionals.
A Working Definition of Cyber Catastrophe
A cyber catastrophe can be described as an infrequent cyber incident that generates severe financial loss, operational disruption, injury, or property damage across a large population of insured cyber exposures. Such an event typically begins with the disruption of a critical technology or service provider and propagates wherever technical or operational conditions allow.
Technology-driven cyber catastrophes commonly develop through three stages:
- Expansion — during which the event rapidly spreads and accumulates losses
- Remission — where the pace of loss begins to slow
- Transition — when the event degrades into recurring or attritional loss patterns
This lifecycle may extend from one month up to six months and provides a practical reference point for defining applicable time windows, including the basis for cyber hours clauses in reinsurance contracts. Importantly, this definition avoids dependence on attribution, and applies regardless of whether coverage is affirmative or silent.
"By emphasizing the impact of the event on insured organizations rather than the identity or intent of the attacker, this approach places financial consequence at the core of modeling and portfolio management."
Marco Lo Giudice
Head of Cat Modeling, Cyberwrite
Why Inconsistent Definitions Create Market Risk
In traditional natural catastrophe modeling, standardized definitions guide the assessment of frequency, severity, and loss accumulation. Cyber catastrophes, however, introduce additional layers of complexity. The novelty of cyber insurance as a product, combined with the relative rarity of truly large-scale systemic cyber events, means that modeling must often rely on extrapolation from observed incidents and hypothetical scenarios.
Without a shared definition of what constitutes a cyber catastrophe, different teams within the same organization — underwriting, cat modeling, claims, and legal — may reach conflicting conclusions about whether a given event triggers aggregate limits, hours clauses, or reinsurance recoveries. This inconsistency creates both financial and reputational risk.
Distinguishing Attritional from Catastrophic Loss
Not all large cyber events are catastrophes. The distinction matters for modeling, pricing, and reinsurance structuring. Attritional losses — frequent, relatively low-severity events affecting individual insureds — should be modeled separately from true systemic events affecting many insureds simultaneously through shared infrastructure dependencies.
Cyberwrite's approach draws a clear line between these categories by modeling events from the technology dependency layer up — starting with the affected infrastructure component and mapping outward to all insureds that depend on it. This produces a realistic picture of correlated loss potential that single-risk assessments alone cannot capture.
Implications for Cyber Hours Clauses
The three-stage lifecycle model described above has direct implications for the structuring of cyber hours clauses in reinsurance treaties. A lifecycle of one to six months suggests that standard 168-hour or 720-hour clauses used in property cat may not adequately capture the full loss accumulation period for a systemic cyber event.
Industry practitioners and reinsurance lawyers should revisit hours clause definitions with this lifecycle model in mind — particularly for events involving prolonged software compromise, supply chain infiltration, or multi-stage ransomware campaigns where losses can accrue over extended periods.