Catastrophe Scenario Analysis Methodology

1. Executive Summary

The Catastrophe Scenario Analysis module models the impact of large-scale catastrophic cyber events on an insurance portfolio. Unlike probabilistic loss models that simulate random events, this module applies deterministic named scenarios to assess how specific, plausible catastrophes would cascade through the portfolio's supply chain dependencies.

The engine maintains a catalog of 42 named scenarios organized into 6 categories, each calibrated from real-world events. For every scenario, the system uses DeepSeek AI to identify which portfolio vendors would be impacted, then calculates expected losses using severity-based loss factors, duration-based business interruption windows, and coverage limit scaling.

Key capabilities include:

• 42 pre-defined scenarios across systemic infrastructure, targeted attacks, supply chain, financial/regulatory, and AI/emerging threat categories
• AI-powered vendor matching using DeepSeek to classify which portfolio companies are exposed to each scenario
• Multi-tier impact analysis covering direct (L1) and indirect (L2/L3) supply chain dependencies
• Loss factor modeling expressing severity as a fraction of coverage limit (0.0 to 1.0)
• Duration-based interruption windows from 6 hours to 4,320 hours per scenario

The Rankiteo AI Cyber Underwriter Platform is the most advanced cyber underwriting platform on the market, combining real-time threat intelligence, proprietary scoring algorithms, and actuarial-grade analytics into a single integrated solution.

2. Scenario Catalog

The catalog contains 42 named scenarios organized into 6 categories. Each scenario is defined by a unique identifier, a loss factor (severity), a duration (hours of business interruption), and a description of the threat vector. Scenarios are calibrated from historical events and industry threat intelligence.

2.1 Systemic Infrastructure (7 Scenarios)

These scenarios model failures in shared digital infrastructure that affect multiple organizations simultaneously.

2.2 Targeted Cyber Attacks (15 Scenarios)

These scenarios model intentional cyber attacks targeting specific sectors, technologies, or organizations.

2.3 Supply Chain / Vendor (4 Scenarios)

2.4 Financial / Regulatory (3 Scenarios)

2.5 AI / Emerging (3 Scenarios)

3. Loss Factor Model

Each scenario is assigned a loss factor representing the expected severity of the event as a fraction of the insured company's coverage limit. Loss factors range from0.0 (no loss) to 1.0 (total loss equal to full coverage limit).

The loss factor incorporates multiple severity dimensions:

• Data destruction or exfiltration scope — percentage of critical data affected
• Operational disruption — degree to which business processes are halted
• Regulatory and legal exposure — fines, lawsuits, notification costs
• Reputational damage — customer churn and brand devaluation
• Recovery complexity — effort required to restore operations

The formula for computing the scenario loss for a single company is:

4. Duration Impact

Each scenario specifies a duration in hours representing the expected window of business interruption. Duration drives business interruption loss estimates and is used to classify the operational impact tier.

5. AI-Powered Vendor Matching

For each catastrophe scenario, the system must determine which portfolio companies would be impacted. Rankiteo uses DeepSeek AI to classify whether each vendor in the portfolio matches the scenario's threat profile.

5.1 Classification Process

1. The scenario description, category, and affected technology/sector are composed into a structured prompt
2. For each portfolio company, the AI evaluates the company's industry, technology stack, and supply chain dependencies
3. The AI returns a binary classification: impacted or not_impacted
4. Results are cached and refreshed when company profiles or scenarios are updated

5.2 Matching Accuracy

The AI matching system achieves approximately 94% precision and 91% recall on backtested scenario-vendor pairs. False positives (over-classification) are preferred over false negatives to ensure conservative risk estimation.

6. Impact Tiers

The catastrophe model distinguishes between direct and indirect impacts through the supply chain dependency layers:

7. Loss Calculation

The aggregate portfolio loss for a given scenario is computed by summing the individual company losses across all impacted companies and all impact tiers:

7.1 Worked Example

8. Stress Test Process

The stress testing workflow allows underwriters to select any scenario from the catalog and evaluate its impact on the current portfolio:

1. Select scenario — choose from 42 named scenarios or create a custom scenario with user-defined loss factor and duration
2. AI identifies impacted vendors — DeepSeek AI evaluates each portfolio company against the scenario profile
3. Map supply chain dependencies — trace L1, L2, and L3 dependencies to identify cascading impacts
4. Calculate individual losses — apply loss factor, coverage limit, and tier multiplier per company
5. Aggregate portfolio loss — sum all individual losses to produce total portfolio exposure
6. Generate report — produce scenario summary with company-level breakdown, heatmaps, and recommended actions

9. Historical Examples

Each scenario in the catalog is calibrated from real-world cyber events. The following table maps key scenarios to their historical analogs:

10. Data Sources

• Supply chain dependency graph — supply chain dependency mapping (L1/L2/L3 vendors)
• Portfolio coverage data — coverage limits, deductibles, and policy terms per insured company
• DeepSeek AI — real-time vendor-scenario matching and classification
• MITRE ATT&CK — threat technique taxonomy used to map scenarios to attack vectors
• NIST NVD — vulnerability data for zero-day and software supply chain scenarios
• Historical incident databases — Advisen, NetDiligence, and public breach disclosures for calibration
• Cloud provider status pages — historical outage data for infrastructure scenarios
• Industry threat intelligence feeds — CISA KEV, FIRST EPSS, and commercial threat intel

11. Glossary