Cyber accumulation management: which insureds a vendor event exposes, and how much limit, within the hour
Exposed insureds and limit listed the day a vendor event breaks.
See one case, screen by screen ↓It is knowing how much of a cyber book rides on one shared cause — a cloud region, an identity provider, a payroll vendor — so a single outage or breach does not surprise the board or the reinsurers. Cyber Accumulation Management keeps a standing map of shared vendors and the insureds that depend on each, with the limit and dependent business interruption sublimits exposed.
How to choose AI solutions for insurance →
Updated
When a widely used cloud, identity, payroll or managed-IT vendor goes down, the board and the reinsurers ask one question: how much of our limit is sitting on it? The answer is scattered. It sits in application answers (“primary hosting provider”), in outside-in scans and in managed-IT disclosures that nobody has indexed by vendor.
So the team searches applications and calls brokers by hand, and the first figure reaches leadership days later — usually a total limit, not an estimate. Dependent business interruption cover differs insured by insured: waiting periods from 6 to 24 hours, system-failure cover often absent or sublimited, different retentions. Without those terms, the estimate means little, because in a short outage most insureds never pass their waiting period.
Estimated split, in hours, for one shared-vendor outage, by hand and with the solution.
Six agents watch vendors, match every dependency to its evidence and estimate the outage; the head of cyber decides.
Monday 12 October, 06:12 ET: Nimbara Cloud reports elevated errors for compute and storage in its US-East 3 region. Here is what happens next at Thistlebrook Specialty’s cyber book, screen by screen, in the working solution.
Rhea opens the dependency web: $2.93B of aggregate limit, 2,846 insureds in ten sector wedges, 11 shared vendors in the centre. One vendor is over the $300M tolerance, and the live bar at the top already carries EV-0412, the Nimbara Cloud US-East 3 outage, with its clock running.
“1 vendor over the $300M tolerance. Choose one to light every insured that depends on it.”
Rhea chooses Nimbara Cloud. A line runs to every insured that depends on it, coloured by how we know: 236 seen in scan, 131 declared on application, 51 through a provider. The rail totals it: 418 insureds, $340M of limit, $181.5M of dependent-BI sublimits, 41 brokers — $40M over the board’s tolerance.
The event watcher read the status page notice and matched it to Nimbara Cloud in the vendor register. The dependency matcher found the insureds in scans, applications and provider disclosures. The policy reader read all 418 in-force policies: 63 have no system-failure cover. Each step shows its time, and the match can be re-run at any point.
“Increased error rates for compute and storage in US-East 3” — the notice is quoted with its time.
The agents open watches; only the head of cyber declares an event. Rhea declares EV-0412, and outreach and the reinsurer note start. The event workspace keeps one timeline of sources, agent steps and people’s decisions, the exposure by evidence type, and every notice of circumstance as it lands.
Rhea’s decision, on the record: “Over tolerance — start outreach and the note.”
One press and a slider from 2 to 72 hours. Every insured whose waiting period plus recovery is passed turns red on the web. At 12 hours, 258 of 418 pass their waiting period and 186 lose more than their retention: $9.32M estimated business interruption gross, $6.52M net of the 30% quota share — inside the $10M retention of the Vauclair Re event cover.
An estimate is never a reserve — every figure is labelled an estimate.
Two sources say Calloway depends on Nimbara: the 11 Oct scan found its booking and transport-management hosts on Nimbara US-East 3 addresses, and its April application names “Nimbara Cloud, US-East region” as primary hosting. Its policy: $10M limit, $5M dependent-BI sublimit covering system failure, 8-hour waiting period, $250k retention. 12 hours plus 3 hours of recovery, less the waiting period, is 7 covered hours at $275.6k an hour, less the retention: $1.68M.
Notice of circumstance received 08:55 from Brightwater Risk Partners; claim file opened by Dana Osei.
The scenarios screen draws the estimate across outage lengths, by system failure or malicious attack, with the waiting-period bands and a split by sector. The event cover attaches at $14.3M gross — about 14.5 hours of downtime. At 24 hours the estimate is $40.4M gross and $28.3M net, and Vauclair Re would pay $18.3M.
The outreach drafter wrote one email for each of the 41 brokers, with that broker’s exposed insureds attached and what to ask them: are operations affected, since when, and how to notify a circumstance. Brightwater Risk Partners holds 126 of the 418. Kiran reads it and presses Send.
“Nothing goes out until an underwriter presses Send.”
Event note 1 is addressed to Martin Adeyemi, Orrin Re and Vauclair Re: what happened, who is exposed, the estimate at 12, 24 and 48 hours, reinsurance, and what the team is doing. Every number carries a numbered citation to its record — the status page, the dependency match, the estimate assumptions, the reinsurance programme, the notices and the outreach.
Rhea reads the note and signs it. It goes to Martin Adeyemi, Orrin Re and Vauclair Re as notice of a potential event under both 2026 treaties — three and a half hours after Nimbara’s first notice.
“Figures are estimates at 12, 24 and 48 hours. Signing confirms you have read them.”
The same event, seen by the five people who carry it — what their day looked like, and what it looks like now.
Six agents watch vendors, match every dependency to its evidence and estimate the outage; the head of cyber decides.
Reads vendor status pages, security advisories and the known-exploited vulnerabilities list every five minutes, matches the vendor to the shared-vendor register by name, product and region, and opens a watch.
Finds every insured that depends on the vendor from outside-in scans, application answers and provider disclosures, with the evidence type, the record and its date.
Reads limit, dependent business-interruption sublimit, waiting period, retention and system-failure cover from each in-force policy and every endorsement in force on the event date.
Estimates business interruption insured by insured for an outage length and cause — outage plus recovery, hours past the waiting period, less retention, capped at the sublimit — then gross, ceded and net of reinsurance.
Drafts one email per broker listing its exposed insureds, asking whether operations are affected and reminding how to notify a circumstance.
Drafts the one-page event note for the chief underwriting officer and the reinsurers: what happened, who is exposed, the estimate at three outage lengths, reinsurance and next steps.
Declares the event and signs every note. The agents propose; a named person decides.
Rhea and the cyber team ask in plain words. The answers come from the dependency web, the policies and the event record, with citations.
What if Nimbara stays down for 12 hours?
At 12 hours, 258 of the 418 insureds pass their waiting period once recovery is added, and 186 lose more than their retention. Estimated business interruption is $9.32M gross, $2.8M ceded to Orrin Re under the 30% quota share, $6.52M net — inside the $10M retention of the Vauclair Re event cover. 63 insureds have no system-failure cover and count only if the cause turns out to be malicious.
Why is Calloway Freight counted?
Two independent sources. The 11 Oct scan found book.callowayfreight.com and its transport-management API on Nimbara US-East 3 addresses, and the April 2026 application answers question 14, primary hosting provider, with “Nimbara Cloud, US-East region”. With an 8-hour waiting period and a $250k retention, it is the largest single estimate at 12 hours: $1.68M.
When does the Vauclair Re event cover attach?
At about 14.5 hours of Nimbara downtime. The event cover is $20M excess of $10M on the net after the 30% quota share. At 24 hours the estimate is $40.4M gross, $28.3M net, and Vauclair Re would pay $18.3M. The note to the reinsurers already says so.
Which brokers have the most exposed limit?
Brightwater Risk Partners, by a distance: 126 of the 418 insureds and $102.25M of the $340M. Then Calder & Rowe (37, $44.5M), Hollis Fenwick Brokers (26, $26.25M) and Tidewell Specialty Brokers (14, $22.25M). Kiran Bhatt sent Brightwater’s email at 09:12; the other 40 wait for an underwriter.
13 screens from the working solution, on its sample data. Pick one to see it large.
Tolerances, the estimate’s assumptions and who decides are settings, not a project.
| Setting | Default | Choose from |
|---|---|---|
| Limit tolerance per vendor | $300M, set by the board | $150M to $500M, in $25M steps |
| Put a vendor on the watch list at | 90% of tolerance | 80 · 90 · 95 % of tolerance |
| New business on an over-tolerance vendor | Refer to the head of cyber | Refer · Allow, note on file · Decline |
| Count dependencies found only through a provider | On | On · Off |
| Recovery after the vendor is back | 3 hours | 2 · 3 · 6 hours, when the application gives none |
| Quota share ceded | 30%, Orrin Re | 25 · 30 · 35 % |
| Event cover | $20M xs $10M, Vauclair Re | $20M xs $10M · $30M xs $10M |
| Who declares the event and signs the note | Head of Cyber | Head of Cyber · Chief Underwriting Officer |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample cyber book · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (CyberCube estimate of the July 2024 outage: $0.4–1.5bn, 3–10% of about $15bn of premium; Munich Re, Cyber Insurance: Risks and Trends 2025; Corvus on dependent business interruption). People, companies, vendors and reinsurers named on this page are fictional — characters and sample data in the working solution.
It is knowing how much of a cyber book rides on one shared cause — a cloud region, an identity provider, a payroll vendor — so a single outage or breach does not surprise the board or the reinsurers. Cyber Accumulation Management keeps a standing map of shared vendors and the insureds that depend on each, with the limit and dependent business interruption sublimits exposed.
From three kinds of evidence: outside-in scans, answers on the cyber application, and managed-IT or software provider disclosures. Each dependency shows its evidence and date. Dependencies through a provider are kept separate, and you choose whether to count them.
Interruption is the outage length plus the insured’s recovery time from its application (3 hours when it is silent). Hours up to the policy’s waiting period are not covered; income lost per hour from the application’s worksheet times covered hours, less the retention, is capped at the dependent-BI sublimit. A system failure counts only policies that cover it; a malicious attack counts all.
Yes. The estimate goes from gross to the quota share ceded, to net, to the event excess of loss cover, and shows the outage length at which the event cover attaches. Treaty terms are settings.
No. The agents watch, match, read policies, estimate and draft. The head of cyber declares the event and signs the note; nothing reaches a broker until an underwriter presses Send, and nothing reaches a reinsurer unsigned.
Yes. The per-vendor limit tolerance, the watch-list threshold, how new business on an over-tolerance vendor is handled, recovery time, quota share and event cover, and who declares and signs are all settings. Assumptions are changed by the portfolio manager and versioned.
Every vendor your insureds share — in the working solution, 11: cloud hosting, identity, endpoint security, email, payroll, ERP, managed file transfer, health records, managed IT and point of sale. You can add a vendor, and the dependency matcher looks for it in scans, applications and provider disclosures.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your applications, scan feed, policy wordings and reinsurance programme — and it goes live once every quality gate has passed. We will walk you through it on your own book first.
Control gaps found before the quote, each linked to the answer or scan.
1-min demoPolicy Wording ComparisonEvery deviation from your form found in minutes, none bound without an approver.
1-min demoClause Library & Precedent SearchA cited precedent in seconds, not an email to the one specialist who knows.
1-min demoWe’ll map your own shared vendors and run a past vendor event against your in-force book.