The impact of the COVID-19 pandemic has dramatically influenced every aspect of how we live, work and think about systemic risk. During the course of 2020, as the pandemic became ingrained in the public consciousness, ever more seemingly technical modeling vocabulary crept into the media. R numbers; flattening the curve; logarithmic scales; second order uncertainty and the like. It occurred to me that pandemics as a systemic risk have a lot in common with how we think about cyber risk. Cyber risk models aim to understand and articulate the systemic risk potential arising from the increasingly hyper-connected technological world in which we operate, both in our economy and wider society.
As the pandemic continues, parallels are emerging in how pandemics are modeled, the methodologies employed, and the data challenges which exist. Over the past couple of months, I have been holding discussions with pandemic risk modeling experts at Munich Re, and leading specialist pandemic modeling company Metabiota to discuss these trends and to produce a report “Viruses, contagion and tail risk: modeling cyber risk in the age of pandemics”. They provided insights to compare and contrast pandemic modeling and cyber risk modeling methodologies, and understand common lessons learned in how to represent complex, rapidly-changing and challenging risks.
Dr. Hjalmar Böhm, Senior Actuary, Epidemic Risk Solutions, a dedicated business unit at Munich Re which has existed for several years and offers both life and non-life insurance solutions, notes in the report: “In both cyber risk and pandemics, there is a need to consider accumulation risk. For example, a pandemic is a key consideration for life insurers and a high mortality event could create significant economic loss. A solid approach to controlling accumulation risk exposure needs to be the basis for every business model for epidemic risk insurance”. One other common theme is that both cyber risk and pandemics can be unencumbered by geographic boundaries. Some pandemics have remained regional, as have cyber events, although they both have the potential to become global.
Modelers are required to develop extrapolations of actual events to represent possible outcomes where combinations of threat vectors come together in ways which could create significant systemic impact. Nita Madhav, CEO of Metabiota, said: “There are parallels with modeling the global spread of a disease and how cyber systems are connected - both are network issues. The impact of mitigation risk and early action can potentially make a difference. Furthermore, you can be asymptomatic with COVID-19. Similarly, you may not know if an intruder has already infiltrated your network.”
It is clear that lessons can be learnt and applied to cyber risk modeling from understanding how pandemic models have evolved. Addressing the current limitations in data collection will improve the value and insight models provide. Models can support data-driven capital management decisions to improve the resilience of the (re)insurance industry in the face of significant accumulation events. These models do not have precise predictive powers, but provide an ever-improving finely tuned representation of potential extreme outcomes, as witnessed by the dramatic health and economic consequences of COVID-19. When a truly global systemic cyber event occurs, by being better prepared, and understanding how capital can be managed to address tail risks, the insurance industry, and by extension the companies which rely on it to recover from such events, will be more sustainable, and better able to weather the storm.
Another key takeaway from the comparison of cyber risk and pandemic models is how to represent the complex interactions between human-created risks. Although pandemics originate from naturally occurring pathogens, the challenge facing modelers is how to illustrate the range of outcomes based on individual and societal reactions to impact the spread of disease. There is ongoing value in learning from interdisciplinary teams in how to balance the needs of accuracy and precision in developing models to meet the market needs.
