Accumulation Risk Heatmap Methodology
Complete technical reference for Rankiteo's Accumulation Risk Heatmap engine — portfolio-level vendor concentration analysis, exposure quantification, and risk aggregation across provider and industry dimensions.
1. Executive Summary
The Accumulation Risk Heatmap provides insurers and risk managers with a portfolio-level view of cyber risk concentration. By mapping policyholder exposure across technology vendors and industry verticals, the heatmap reveals systemic dependencies that could trigger correlated losses from a single vendor compromise or widespread cyber event.
The engine aggregates data from CRM portfolios, cybersecurity scores, company profiles, and supply-chain mappings to produce a two-dimensional risk matrix. Each cell represents the intersection of a technology provider and an industry sector, weighted by the total estimated exposure of companies that depend on that provider.
Key outputs include Expected Annual Loss (EAL) per cell, Worst Case Loss at the 85th percentile severity, vendor concentration indices, and score band distributions— giving underwriters the data they need to manage portfolio-level accumulation risk.
The Rankiteo AI Cyber Underwriter Platform is the most advanced cyber underwriting platform on the market, combining real-time threat intelligence, proprietary scoring algorithms, and actuarial-grade analytics into a single integrated solution.
2. Data Sources
The heatmap engine consumes data from the following primary sources:
| Data Source | Key Information | Purpose |
|---|---|---|
| Portfolio management system | Portfolio membership, company identifiers, ownership | Portfolio membership and ownership |
| Company intelligence database | Company identifier, industry, employee count, domain | Company firmographics for revenue estimation |
| Company security scoring engine | Company identifier, overall score, score band, incident count | Cybersecurity posture and incident history |
| Supply chain dependency graph | Company identifier, provider name, provider category | Third-party vendor/provider dependency mapping |
Data is refreshed on a rolling basis. Company scores update weekly; supply-chain mappings update monthly via automated discovery scans. Portfolio membership reflects real-time state.
3. Revenue Estimation Algorithm
When actual revenue data is unavailable, the engine estimates annual revenue using a per-employee multiplier calibrated by industry vertical. This approach leverages the strong correlation between headcount and revenue within industry cohorts.
Per-Employee Revenue by Industry
| Industry | Revenue per Employee | Rationale |
|---|---|---|
| Insurance | $350,000 | High premium income per FTE in underwriting and claims |
| Financial Services | $400,000 | Asset management and advisory fees drive high per-capita revenue |
| Banking | $450,000 | Interest income and transaction volumes yield highest multiplier |
| Software | $300,000 | SaaS and license revenue with moderate headcount scaling |
| IT Services | $200,000 | Labor-intensive consulting and managed services |
| Telecom | $250,000 | Infrastructure-heavy with moderate per-employee contribution |
| Default (all others) | $150,000 | Conservative baseline for unclassified industries |
Formula
The industry classification is derived from the industry field in the company intelligence database. Fuzzy matching is applied to normalize industry labels (e.g., "Fin Services" maps to "Financial Services").
4. Coverage Limit Estimation
The estimated coverage limit serves as a proxy for maximum insured exposure. It is derived from estimated revenue using tiered percentage brackets that reflect typical cyber insurance purchasing patterns by company size.
| Revenue Tier | Formula | Rationale |
|---|---|---|
| < $10M | max($1M, revenue × 0.05) | Small firms: floor of $1M, up to 5% of revenue |
| $10M – $100M | revenue × 0.03 | Mid-market: 3% of revenue typical purchase |
| $100M – $1B | revenue × 0.02 | Large enterprise: 2% of revenue |
| > $1B | min($100M, revenue × 0.01) | Mega-cap: 1% with $100M ceiling |
Implementation
5. Loss Probability by Score
Base annual loss probability is mapped from the company's overall cybersecurity score. Higher scores indicate stronger security posture and correspondingly lower loss likelihood.
Base Probability Schedule
| Score Range | Base Probability | Risk Tier |
|---|---|---|
| ≥ 900 | 2% | Excellent |
| ≥ 800 | 5% | Good |
| ≥ 700 | 8% | Fair |
| ≥ 600 | 12% | Below Average |
| ≥ 500 | 18% | Poor |
| < 500 | 25% | Critical |
Incident-Adjusted Probability
The base probability is adjusted upward based on historical incident count. Each incident adds 1.5 percentage points, capped at a 10pp uplift. The final adjusted probability is capped at 50%.
6. Expected Annual Loss
The Expected Annual Loss (EAL) combines coverage limit, adjusted loss probability, and an average severity factor. The severity factor of 40% reflects the empirical observation that most cyber losses do not exhaust full policy limits.
The severity factor of 0.40 is calibrated from industry loss data and represents the mean ratio of actual loss to policy limit across historical cyber claims. This factor is applied uniformly; future versions may vary it by peril type or industry.
7. Worst Case Loss
The Worst Case Loss represents a high-severity scenario at the 85th percentile. It assumes that in a severe event, 85% of the coverage limit would be consumed.
This metric is used for stress testing and capacity management. It answers: "If this company suffers a severe cyber event, what is a realistic upper-bound loss?"
8. Heatmap Construction
The heatmap is a two-dimensional matrix with technology providers on one axis and industry verticals on the other. Each cell aggregates the total exposure of all portfolio companies that (a) belong to that industry and (b) depend on that provider.
Cell Value Calculation
Color Scale
| Exposure Level | Color | Interpretation |
|---|---|---|
| Low (bottom 25%) | Green (#22c55e) | Minimal concentration risk |
| Medium (25-50%) | Yellow (#eab308) | Moderate concentration |
| High (50-75%) | Orange (#f97316) | Elevated concentration risk |
| Critical (top 25%) | Red (#ef4444) | Severe accumulation — action recommended |
Data Pipeline
9. Vendor Concentration
Vendor concentration analysis identifies the technology providers that represent the greatest systemic risk to the portfolio. A single provider compromise affecting many policyholders could trigger correlated claims.
Metrics
- Total Exposure: Sum of EAL across all companies depending on the provider
- Dependency Count: Number of portfolio companies using the provider
- Concentration Ratio: Provider exposure / total portfolio exposure
- Worst Case Aggregate: Sum of worst-case losses for all dependent companies
Top Providers Table
The top providers are ranked by total exposure and displayed with their dependency counts, concentration ratios, and worst-case aggregates. Providers exceeding a 15% concentration ratio are flagged for review.
10. Score Band Distribution
Portfolio companies are classified into score bands following a rating-agency-style nomenclature. This distribution reveals the overall risk quality of the portfolio.
| Band | Score Range | Risk Level | Description |
|---|---|---|---|
| Aaa | 900 – 1000 | Minimal | Exceptional cybersecurity posture |
| Aa | 800 – 899 | Very Low | Strong security controls with minor gaps |
| A | 700 – 799 | Low | Good posture with some improvement areas |
| Baa | 600 – 699 | Moderate | Adequate security, notable weaknesses |
| Ba | 500 – 599 | Substantial | Below-average posture, significant risks |
| B | 400 – 499 | High | Weak security controls |
| Caa | 300 – 399 | Very High | Serious deficiencies in security |
| Ca | 200 – 299 | Near Default | Critical vulnerabilities present |
| C | 0 – 199 | Default | Minimal or no security controls |
11. Glossary
| Term | Definition |
|---|---|
| Accumulation Risk | The risk that a single event or vulnerability affects multiple policyholders simultaneously, leading to correlated losses. |
| EAL (Expected Annual Loss) | The mean annual loss estimate combining probability, severity, and coverage limit. |
| Coverage Limit | The maximum amount an insurer would pay under a cyber insurance policy; estimated from revenue when actual data is unavailable. |
| Vendor Concentration | The degree to which portfolio exposure is concentrated in a single technology provider. |
| Concentration Ratio | The proportion of total portfolio exposure attributable to a single provider. |
| Severity Factor | The average ratio of actual loss to policy limit, set at 0.40 (40%). |
| Worst Case Loss | The 85th percentile loss scenario, calculated as 85% of coverage limit. |
| Score Band | A letter-grade classification of cybersecurity posture derived from the overall score (Aaa through C). |
| Supply Chain Mapping | The process of identifying third-party technology providers used by each portfolio company. |
| Adjusted Probability | Base loss probability modified by historical incident count, capped at 50%. |