Cyber catastrophe modeling analyst: the five seats around one outage

A cyber catastrophe modeling analyst estimates how much a cyber insurer could lose when one event reaches many insureds at once: a cloud region failing, a defective software update crashing machines, a self-spreading piece of malware. Between events the job is modelling, turning exposure data and scenarios into return periods for the board and the reinsurance buyer. On the morning a shared vendor goes down, it becomes a different job: naming the exposed insureds, reading their policy terms and putting an estimate, not a total limit, in front of people who have to act on it. That morning is answered by five seats, and most of the lost time sits in the handoffs between them. Botminds' Cyber Accumulation Management is an agentic solution built for that morning: agents keep a map of which insureds depend on which vendor, read the policies and draft the estimate, while people declare, send and sign.

The examples come from a fictional sample book as it runs through the solution: Thistlebrook Specialty, 2,846 insureds and $2.93 billion of aggregate cyber limit, on the Monday its main cloud vendor's US-East 3 region fails at 06:12 ET. Every company, person and reinsurer in it is invented. Research figures come from regulators and official statistics, linked where they appear.

What does a cyber catastrophe modeling analyst do?

A cyber catastrophe modeling analyst measures correlated loss: what a single cause would cost across the whole book, and how often a cause that large is likely to arrive. The analyst assembles exposure data on every insured (sector, revenue, limits, sublimits, technology), runs it through a probabilistic model or a set of fixed scenarios, and reports the results to the people who set appetite and buy reinsurance. The output is a curve of loss against likelihood and a short list of scenarios the board can picture, such as a week-long outage of the largest cloud provider.

The role sits at an unusual junction. Part of it is actuarial: return periods, gross and net loss, the attachment points of the reinsurance. Part of it is security: knowing why a misconfigured storage service, an identity provider outage and a worm in a tax-software update produce different patterns of loss. And part of it is underwriting, because the policy terms decide what a technical event costs. New York's Department of Financial Services wrote the expectation plainly in its 2021 cyber framework: "Insurers that offer cyber insurance need appropriate expertise to properly understand and evaluate cyber risk" (NYDFS Insurance Circular Letter No. 2, 2021).

No official occupation series counts cyber catastrophe analysts, so the nearest public figures describe the two trades the role borrows from. The U.S. Bureau of Labor Statistics counts actuaries and insurance underwriters separately; neither series breaks out cyber, catastrophe or exposure management work.

The market those people serve has grown quickly. The NAIC reported that U.S. domestic cyber premium grew from $2.75 billion to $7.46 billion between 2020 and 2025, "(or $9.46 billion, including alien surplus lines)", and that reported cyber claims "increased 20% to 56,323" in 2025 (NAIC news release, 21 October 2026). More policies on the same few clouds, identity providers and payroll platforms is exactly the condition that makes one vendor's bad morning everyone's.

Who manages cyber accumulation in an insurer? Five seats, one event

In most cyber books, accumulation is owned by a head of cyber and measured by an exposure analyst or portfolio manager, but it is acted on by five seats: the analyst, the head of cyber, the underwriters, claims, and the chief underwriting officer with the reinsurance buyer. Each needs a different cut of the same facts. The analyst needs dependencies with evidence; the head of cyber needs limit against tolerance; underwriters need a list per broker; claims needs to know who will call; the chief underwriting officer needs a number to stand behind.

The trouble is that these cuts are usually produced in sequence, by hand, from documents nobody has indexed by vendor. Which insureds rely on a cloud region sits in application answers ("primary hosting provider"), in outside-in scan results and in what managed-IT firms disclose about the platforms they run for their clients. Until someone pulls those together, every later seat waits.

The Prudential Regulation Authority saw the same pattern when it surveyed UK specialist insurers on cyber in 2018. Firms with the most developed approaches had built processes "by bringing together different parts of the organisation (eg underwriting, risk, claims, IT, actuarial)" (PRA letter to chief executives, 30 January 2019). That sentence is a job description for the accumulation function: it is less a desk than a junction.

Why the handoffs, not the model, decide the first day

The catastrophe model answers how bad a year could be. On the day of an outage nobody is asking that; they are asking which insureds are down, how much limit is on them, and what the loss looks like if the vendor is back by lunch or by tomorrow. A model's industry exposure database cannot name Thistlebrook's insureds, and its event catalogue does not know what the vendor's status page said at 06:12.

By our estimate, the first defensible exposure figure for a single shared-vendor outage takes about three working days when it is built by hand, and most of that time goes to finding out who depends on the vendor. The split below is ours, not a survey; it is how the hours fell when we walked the sample book's outage through the manual steps a cyber desk typically takes.

Read the first band again: four hours in ten go to a question that has nothing to do with modelling. It is a search problem. The insured's application says "Nimbara Cloud, US-East region"; a scan shows two of its booking hosts answering from the vendor's addresses; its managed-IT provider runs on the same region. Each of those facts was already in the building before the outage. The handoff stalls because none of them was filed under the vendor's name.

Who declares a cyber catastrophe event?

A named person should declare it, and in most cyber books that person is the head of cyber or the chief underwriting officer. Declaration is a governance act, not an analytical one: it starts broker outreach, claims set-up and the notice to reinsurers, and every one of those has a cost if it is wrong. Leaving it to whoever sees the news first, or to a threshold in a spreadsheet, puts that cost on no one.

The UK supervisor's position on outside help is a useful rule for this decision. The PRA's supervisory statement on cyber underwriting says that whatever outside advice a firm takes, responsibility and accountability for cyber risk stay with the firm, and that the board should oversee how well its controls work (PRA SS4/17, chapter 4). A model vendor, a broker or a software agent can inform the declaration; it cannot make it.

In the solution, the agents open a watch; only the person named in settings declares an event. In the sample book, the event watcher matched the vendor's notice to its register at 06:19, the match and the policy terms were in by 06:24, and the head of cyber, Rhea Whitlock, declared the event at 06:31 with her reason written on the timeline: "Over tolerance — start outreach and the note." The underwriting desk that feeds these seats is described in the cyber underwriter job description. A reinsurer's event room runs a similar decision on the assumed side; the seats in a reinsurer's event room are set out in that series.

The event workspace: sources, agent steps and the declaration on one timeline

What skills does a cyber cat analyst need?

Three, in roughly equal measure: catastrophe modelling, enough security knowledge to read an incident notice and a scan, and enough policy knowledge to know what a waiting period and a dependent business interruption sublimit do to a loss. The first is taught; the second and third are mostly learned on the job, which is why supervisors keep returning to expertise.

The PRA expects the knowledge to "cover all three lines of defence (business, risk management, and audit)" (SS4/17, 4.2). EIOPA, the EU insurance supervisor, asks national supervisors to remind insurers "the importance to acquire the needed expertise, for instance by providing adequate training", and its impact assessment passed on stakeholders' estimate of what that costs: "on average, 5000 euro per employee, plus costs in terms of time of about 70 hours" (EIOPA Supervisory Statement on non-affirmative cyber exposures, 2022).

The policy column is where most first estimates fail. In a short outage, the waiting period, not the limit, decides how many insureds have a loss at all, which is why the waiting period does most of the work in any estimate worth reading.

How do insurers respond to a cloud outage, seat by seat?

They respond in a fixed order: confirm the vendor and the scope of its failure, list the exposed insureds with evidence, read their terms, estimate at a few outage lengths, then tell brokers, claims and reinsurers. The order matters because each step's output is the next seat's input. In the sample, agents carried the first four steps in under half an hour; people made every decision that left the building.

Two details in that sequence are worth copying whatever tools a desk uses. The estimate is drawn at several outage lengths, never one, because nobody knows at 06:40 when the vendor will be back. And the cause is a switch, not an assumption: the same outage costs more if it turns out to be malicious, because policies without system-failure cover then respond too. The first hour of a cloud outage scenario is traced minute by minute in a companion guide.

Who talks to reinsurers after a cyber event?

The head of cyber or the chief underwriting officer does, in writing, and the reinsurance buyer manages the conversation that follows. What the reinsurers need first is not a final number; it is a notice that a potential event exists, the exposed limit, an estimate at a few outage lengths with its assumptions, and where their cover attaches. A treaty's notice clause and its definition of one event decide the rest, and those are questions of treaty wording rather than accumulation; the hours clause in reinsurance is the place to start.

In the sample, the note went to the chief underwriting officer and to both reinsurers as notice of a potential event under the 2026 quota share and the event excess of loss. It said, with numbered citations, that the event cover would attach at about 14.5 hours of downtime and that at 24 hours the estimate was $40.4 million gross, $28.3 million net, with $18.3 million falling to the event cover.

Broker outreach: one drafted email per broker, sent by an underwriter

What the analyst keeps when agents take the search

The analyst keeps the judgement and loses the search. In Cyber Accumulation Management the assumptions behind the estimate (recovery time when an application is silent, the cause rules, the reinsurance terms) change only with the portfolio manager's approval and are versioned; the sample's current set, v3, was approved on 2 September 2026. The analyst also owns the question of which evidence counts: whether a dependency found only through a managed-IT provider is counted, and how stale a scan may be before it stops counting.

Two things the solution does not do, and the analyst should not expect it to. It does not replace a probabilistic model: it produces a named list and an estimate for an event that is happening or a scenario you choose, not a return period for the year. And its figures are estimates, labelled as such on every screen; claims and reserving stay with the people who own them. Where each method fits is compared in three ways to count cyber accumulation.

Questions people ask

Is a cyber catastrophe modeling analyst the same as an actuary?

Not usually. Many come from actuarial or catastrophe-modelling backgrounds, but the role also needs security literacy and policy-wording knowledge that actuarial training does not cover. BLS counts about 31,200 actuaries in the United States and no separate cyber catastrophe series.

What is an exposure management analyst in cyber insurance?

An exposure management analyst keeps the book's exposure data clean and runs it through models and scenarios: limits, sublimits, sectors, and in cyber the technology each insured depends on. In cyber the hardest part of that data is the dependency on shared vendors, because it is spread across applications, scans and provider disclosures.

Who should own the per-vendor limit tolerance?

The board should set it and the head of cyber should run against it. New York's 2021 cyber framework expects a board-approved cyber risk strategy with quantitative goals reported back regularly, and a per-vendor tolerance is the most direct of those goals for accumulation. In the sample book it is $300 million, set by the board on 14 March 2026.

How fast can an insurer estimate exposure to a vendor outage?

By hand, our estimate is about three working days to a first figure. In the fictional sample, the solution matched 418 insureds and $340 million of limit 12 minutes after the vendor's first notice, and the signed note left three and a half hours after it.

What does a cyber cat analyst send the board after an event?

One page: what happened, who is exposed and how that is known, the estimate at several outage lengths gross and net, where the reinsurance attaches and what the team is doing. Every number should be cited to its source and every estimate labelled as an estimate, not a reserve.

Which regulators expect cyber expertise inside insurers?

At least three say so in writing: New York's DFS in its 2021 cyber framework, the PRA in chapter 4 of SS4/17, and EIOPA in its 2022 supervisory statement. EIOPA's impact assessment passed on a stakeholder estimate of about €5,000 and 70 hours of training per employee.