Cyber Insurance Has a Data Problem: Underwriting a Risk That Changes Weekly

Cyber is the fastest-growing line in insurance and the one where the traditional data playbook helps least. Property underwriters have a century of loss experience and physics that doesn't change. Cyber underwriters are pricing a risk that mutates weekly, against an adversary that adapts on purpose, using historical data that describes a threat landscape which no longer exists. It's less an actuarial problem than a live-data problem — and most cyber programs are still trying to solve it like a traditional line.

Why last year's loss data lies

In property, the past is a decent guide to the future: floods and fires behave roughly as they always have. In cyber, the past is actively misleading. The dominant attack vector shifts, a single vulnerability can create correlated losses across thousands of policyholders overnight, and a control that mattered last year is table stakes this year. A model trained on 2023 ransomware patterns is confidently pricing a 2026 threat surface it has never seen. The data isn't just sparse — it's describing a different world.

The correlation problem nobody prices well

Cyber breaks the core assumption of insurance: independence. Insurers pool risks that fail independently — your house burning down doesn't make mine more likely. Cyber isn't like that. A single compromised software supplier, a single widely-used vulnerability, can trigger simultaneous claims across an entire portfolio. That's accumulation risk that looks more like a catastrophe line than a casualty one — except the "geography" is shared technology, which almost no insurer maps. Do you know how many of your insureds run the same VPN, the same email gateway, the same managed service provider? Most don't, which means they can't see their own accumulation.

The data that actually matters is external and live

  • Outside-in scans. The insured's real security posture — exposed services, unpatched systems, leaked credentials — is observable from the outside and changes constantly. A point-in-time questionnaire at inception is stale within weeks.
  • Threat intelligence. What's being actively exploited right now should influence pricing and alerts, not just an annual review.
  • Technology fingerprinting. Knowing the shared components across your book is the only way to see correlated exposure before it detonates.

None of this fits the annual-underwriting rhythm. Cyber underwriting wants continuous data, and most insurance data platforms are built for periodic batch.

What a cyber-ready data foundation looks like

  1. Continuous monitoring, not point-in-time. Ingest outside-in scan data across the book and treat posture as a live signal — flag deterioration, don't just rate at inception.
  2. Accumulation by technology, not geography. Map shared vendors and components across insureds so you can answer "if vendor X is breached, what's our exposure?" before it happens.
  3. Fast feedback loops. When the threat landscape shifts, the pricing and portfolio view should move in weeks, not at the next annual review.
  4. Fuse internal and external. Your claims and policy data joined to live external threat and posture data — neither is enough alone.

The insurers who win in cyber won't be the ones with the cleverest pricing model. They'll be the ones whose data foundation can ingest live external signal, map correlated exposure, and move at the speed the risk actually moves. Building that kind of foundation — real-time ingestion, entity and technology resolution, fused internal-external data — is exactly what we work on with insurers at IntelliBooks.

You can't underwrite a weekly-changing risk on an annual data cycle. Cyber is a data-velocity problem first and an actuarial problem second.

Comments

Post a Comment

Popular posts from this blog

Why Your Insurance Data Warehouse Didn't Fix Anything

You built the data warehouse. It took eighteen months and cost more than planned. Policy data, claims data, billing — it's all in there. The project was declared a success and everyone moved on. And yet: underwriting still can't see the whole customer. The AI initiative is still stalled. Someone still asks for a report and waits three weeks. Nobody says it out loud, but the question hangs there — what exactly did we buy? You're not alone, and it isn't because you built it badly. It's because a warehouse solves a problem you didn't have. The problem a warehouse solves Warehouses solve location . Before: your data was in eight systems. After: it's in one place. That's genuinely valuable — you can run a query across policy and claims without begging two teams for extracts. But notice what that fixes: it fixes where the data is . It doesn't touch what the data means , whether it's trustworthy, or whether the records refer to who you think t...
Read more

Straight-Through Processing: From 10% to 90%

Straight-through processing is the number every insurance executive quotes and almost nobody achieves. The industry benchmark has moved from 10–15% to 70–90% at the carriers who've cracked it. That's not a marginal efficiency gain — it's a different cost structure. So why is your STP rate still stuck in the teens? Because STP gets treated as a workflow project. It isn't. It's a data problem wearing a workflow costume. What STP actually requires Straight-through means a quote, policy, or claim goes from submission to completion with zero human touches . For that to happen, every decision point in the chain has to be answerable automatically. Every single one. A chain of nine automated steps and one manual check isn't 90% straight-through — it's 0%. One human touch and the whole thing is a manual process with extra steps. That's the bar. And it means the constraint isn't the workflow engine — it's whether the data needed at each decisio...
Read more

Embedded Insurance: Why the API Is the Easy Part

Embedded insurance is the idea that coverage should be offered at the moment of need, inside someone else's product — travel insurance at checkout, device protection when you buy the phone, cover for the rental car in the booking flow. It's one of the fastest-growing distribution models in the industry, and every insurer has a strategy slide about it. Most of those strategies underestimate the same thing, and it isn't the partnerships or the product. It's the data plumbing. Everyone assumes the API is the hard part. The API is the easy part. What embedded insurance really demands The promise of embedded is speed and invisibility: a customer buys a flight and, in the same breath, is offered exactly the right travel cover at exactly the right price, and accepts with one tap. No forms, no friction. Deliver that and you've won. But "exactly the right cover at exactly the right price in one tap" makes brutal demands on your back end: You must price i...
Read more