Loss Exceedance Modeling - Algorithm & Methodology

1. Executive Summary

Rankiteo's Loss Exceedance Modeling engine (v2.1) provides cyber underwriters with a professional-grade Monte Carlo simulation platform for quantifying portfolio-level cyber risk. The engine generates Aggregate Exceedance Probability (AEP) and Occurrence Exceedance Probability (OEP) curves, decomposes losses by cyber peril, computes marginal risk contributions per company, and supports reinsurance layer analysis, catastrophe stress testing, and cat bond pricing with 14 real-world cyber cat bonds from the Artemis Deal Directory.

The model follows FAIR (Factor Analysis of Information Risk) principles: Risk = Poisson(Frequency) × Lognormal(Severity in USD), applied independently per company per peril across 25,000 simulated years. Severity is calibrated to NetDiligence Claims Study 2024 benchmarks in absolute USD, capped by coverage limit, and scaled by company size.

2. Model Architecture

┌─────────────────────────────────────────────────────┐
│                  INPUT PARAMETERS                    │
│  Coverage Limit · Retention · Correlation Factor     │
│  Severity Model · Confidence Levels · Filters        │
└──────────────────────┬──────────────────────────────┘
                       ▼
┌─────────────────────────────────────────────────────┐
│              DATA ENRICHMENT LAYER                   │
│  Portfolio companies from portfolio management system │
│  Scores from company security scoring engine         │
│  Incidents from cyber incident intelligence feed     │
│  Industry, employees, band from company profiles     │
└──────────────────────┬──────────────────────────────┘
                       ▼
┌─────────────────────────────────────────────────────┐
│          PER-COMPANY PER-PERIL FREQUENCY             │
│  6 perils × N companies = frequency matrix           │
│  f(score, incidents, incident_types, peril)          │
└──────────────────────┬──────────────────────────────┘
                       ▼
┌─────────────────────────────────────────────────────┐
│           MONTE CARLO SIMULATION ENGINE              │
│  25,000 simulated years                              │
│  Correlated trigger via common shock factor          │
│  Per-event severity from chosen distribution         │
│  Gross loss → Net loss (after retention)             │
└──────────────────────┬──────────────────────────────┘
                       ▼
┌─────────────────────────────────────────────────────┐
│              OUTPUT COMPUTATION                       │
│  AEP curve · OEP curve · Return period table         │
│  Peril decomposition · Company contributions         │
│  Reinsurance layer · Stress scenarios · Sensitivity  │
└─────────────────────────────────────────────────────┘

3. Peril Definitions

The model decomposes cyber risk into 6 distinct perils, each with calibrated base frequency (Poisson λ) and severity parameters (absolute USD, lognormal):

Severity Distribution Interpretation

For lognormal severity with mean=$4.5M, σ=1.2 (Ransomware):

μ = ln(mean_usd) - σ²/2 = ln(4,500,000) - 1.44/2 = 14.60
Median: e^μ = e^14.60 ≈ $2.2M
Mean: $4.5M (by construction)
95th percentile: e^(μ + 1.645×σ) ≈ $16M
99th percentile: e^(μ + 2.33×σ) ≈ $59M

Loss = min(coverage_limit, raw_severity × size_multiplier)
  → A $4.5M draw for a micro company (0.05x) = $225K
  → A $4.5M draw for a multinational (1.0x) = $4.5M
  → A $59M draw capped at $5M coverage limit = $5M

4. Frequency Model

4.1 Score-Based Frequency Adjustment

Each company's Rankiteo score (0-1000) modulates the base peril frequency:

score_factor = max(0.5, (1000 - score) / 350)

4.2 Incident History Boost

Companies with historical cyber incidents receive frequency uplifts:

incident_boost = min(0.5, total_incidents × 0.03)

Additionally, peril-specific boosts apply when incident types match:

If company has ransomware incidents → ransomware frequency += min(0.1, ransomware_count × 0.02)
If company has breach incidents    → data_breach frequency += min(0.1, breach_count × 0.02)

4.3 Incident Type to Peril Mapping

4.4 Industry Hazard Group Factor

Each industry receives a frequency multiplier based on observed claim rates (aligned with the premium engine's hazard group classification):

4.5 Final Per-Company Per-Peril Poisson Lambda

λ(company, peril) = min(1.0, base_λ × score_factor × industry_factor + peril_specific_boost)

n_events_per_year ~ Poisson(λ)  ← can be 0, 1, 2, 3+ events/year

Cap at λ=1.0 (average 1 event/year). The Poisson distribution allows multiple events per year, critical for capturing multi-hit scenarios that drive tail losses. Under the old Bernoulli model, a company could only have 0 or 1 event per peril per year.

5. Severity Models

Three severity distributions are available, all producing absolute USD loss amounts. The coverage limit acts as a cap, not a scaling factor:

gross_loss = min(coverage_limit, raw_severity_usd × size_multiplier)
net_loss = max(0, gross_loss - retention)

5.1 Lognormal (Default, Recommended)

μ = ln(mean_usd) - σ²/2
raw_severity = lognormvariate(μ, σ)    → absolute USD

• Right-skewed with heavy tail — standard in actuarial cyber modeling
• Calibrated to NetDiligence 2024 claims data (mean USD per peril)
• Coverage limit caps the loss, does not scale it
• Company size multiplier (0.05x–1.0x) adjusts for firm scale

5.2 Pareto (Heavy Tail)

α = max(1.5, 2.5 - σ × 0.5)
raw_severity = (paretovariate(α) - 1) × mean_usd / (α - 1)

• Heavier tail than lognormal — models extreme/catastrophic scenarios
• Use when portfolio is exposed to systemic risks (shared cloud, single vendor)

5.3 Beta (Light Tail)

raw_severity = mean_usd × betavariate(2, 5) × 3

• Lighter tail — models well-contained, attritional losses
• Use for mature portfolios with strong controls and low deductibles

5.4 Size Multiplier Table

5.5 Regional Severity Adjustment

Severity benchmarks are US-based (NetDiligence, IBM/Ponemon). For non-US companies, a regional multiplier adjusts loss amounts to reflect local cost structures:

gross_loss = min(coverage_limit, raw_severity × size_mult × region_mult)

6. Correlation Model

6.1 Common Shock Factor

Inter-company loss correlation is modeled via a common shock approach:

common_shock ~ Uniform(0, 1)    [drawn once per simulation year]

For each company × peril:
    correlated_λ = base_λ × (1 + ρ × (common_shock - 0.5) × 4)
    n_events ~ Poisson(correlated_λ)

Effect: In high-shock years (common_shock > 0.75), all lambdas inflate by ~ρ×2
        In low-shock years (common_shock < 0.25), all lambdas deflate by ~ρ×2

Where ρ is the correlation_factor parameter (default: 0.15).

6.2 Correlation Interpretation

6.3 Effect on Portfolio Risk

Higher correlation increases tail risk (VaR, TVaR) without significantly changing AAL. This reflects the actuarial principle that correlation affects the shape of the loss distribution's tail, not its mean.

7. Monte Carlo Simulation Engine

7.1 Simulation Loop (Poisson + Absolute USD)

For each of 25,000 simulated years:

for year in range(25,000):
    common_shock = random()                    # Systemic factor for this year
    peril_event_totals = {peril: 0 for peril}  # For OEP tracking

    for each company in portfolio:
        size_mult = SIZE_TABLE[company.employees]
        for each peril in [Ransomware, Breach, Cloud, SupplyChain, BEC, SysFailure]:
            corr_λ = base_λ × (1 + ρ × (common_shock - 0.5) × 4)
            n_events = Poisson(corr_λ)         # 0, 1, 2, 3+ events possible

            for each event:
                raw_severity = Lognormal(mean_usd, σ)      # Absolute USD
                gross_loss = min(coverage_limit, raw_severity × size_mult)
                net_loss = max(0, gross_loss - retention)

                AEP_total += net_loss
                peril_event_totals[peril] += net_loss       # Correlated event tracking
                company_loss += net_loss

    OEP = max(peril_event_totals.values())     # Max systemic event across portfolio
    AEP_losses.append(AEP_total)
    OEP_losses.append(OEP)

7.2 Key Design Decisions

• Poisson frequency: A company can have 3 ransomware events in one year. Under Bernoulli (v1.0), max was 1 — this underestimated tail risk by ~20-30%
• Absolute USD severity: A ransomware attack costs what it costs ($4.5M mean) regardless of coverage limit. The limit only caps the payout, not scales the loss
• Size multiplier: Micro companies (0.05x) experience proportionally smaller losses than multinationals (1.0x). Reuses catastrophe module factors
• OEP = max peril event: A systemic ransomware campaign hitting 10 companies counts as one “occurrence” with aggregate loss. More realistic for reinsurance pricing than max single-company loss
• Per-company tracking: Each company's losses are tracked per-simulation for accurate diversification benefit calculation

7.3 Supply Chain Contagion (Network Propagation)

After primary events are generated, the model propagates losses through shared vendor dependencies. This is the key differentiator vs. common-shock-only models (CyberCube uses a similar SPoF Intelligence approach at $200K+/year).

Phase 1: Primary events (independent per company, as above)
         Track contagion-eligible events: supply_chain, cloud_outage, ransomware

Phase 2: Contagion propagation
         For each primary event at Company A (peril = supply_chain/cloud_outage/ransomware):
             For each Company B sharing ≥1 vendor with A:
                 vendor_ratio = shared_vendors / B's_total_vendors
                 contagion_loss = A's_loss × decay_factor × vendor_ratio
                 B's_loss += min(coverage_limit, contagion_loss)

Decay factors (fraction of source loss that propagates):
  supply_chain:  60%  ← SolarWinds/MOVEit-class: high propagation
  cloud_outage:  50%  ← AWS/Azure outage: moderate propagation
  ransomware:    20%  ← Ransomware campaigns: low but non-zero propagation
  BEC:            0%  ← Does not propagate via shared vendors
  data_breach:    0%  ← Company-specific, no vendor contagion
  system_failure:  0%  ← Internal failure, no propagation

The contagion model uses actual supply chain data from Rankiteo's vendor dependency database (same source as the Supply Chain and Catastrophe modules). Before simulation, the model:

• Fetches L1 vendor dependencies for all portfolio companies via batch query
• Builds a shared-vendor matrix: which companies share each vendor
• Creates contagion links: company pairs with shared vendor count
• During simulation, propagates losses with vendor-ratio-weighted decay
• Deduplicates: each target company is only hit once per peril per simulation year

7.4 Reproducibility

random.seed(42) ensures identical results for identical inputs. Stress tests use seed(99).

8. Output Metrics

8.1 AEP vs OEP

8.2 Key Risk Metrics

8.3 Return Period Table

Return periods translate percentiles into underwriter-friendly language:

Each return period shows AEP VaR, AEP TVaR, OEP VaR, and OEP TVaR.

9. Peril Decomposition

Per-peril losses are tracked across all simulations:

For each peril p:
    AAL(p) = Σ(peril_losses[p]) / N
    % of Total AAL = AAL(p) / Total AAL × 100
    VaR 95%(p) = sorted_peril_losses[p][N × 0.95]
    VaR 99%(p) = sorted_peril_losses[p][N × 0.99]
    Max Loss(p) = max(sorted_peril_losses[p])

This allows underwriters to identify which peril class drives portfolio risk and where to focus risk mitigation or sublimit adjustments.

10. Marginal Risk Contribution

10.1 Per-Company Contribution

For each company i:

avg_loss_contribution(i) = Σ(all losses attributed to company i across all sims) / N
pct_of_aal(i) = avg_loss_contribution(i) / AAL × 100

10.2 Diversification Benefit

Measures how much portfolio diversification reduces tail risk vs. sum of individual risks:

sum_individual_VaR99 = Σ(individual VaR99 for each company, estimated from contribution ratio)
portfolio_VaR99 = actual portfolio VaR at 99th percentile

diversification_benefit = (1 - portfolio_VaR99 / sum_individual_VaR99) × 100%

A 15% diversification benefit means the portfolio's 1-in-100 year loss is 15% lower than the sum of individual company 1-in-100 year losses.

11. Reinsurance Layer Analysis

11.1 Layer Structure

An Excess of Loss (XoL) reinsurance layer is defined by:

• Attachment Point: Loss level at which reinsurer starts paying
• Layer Limit: Maximum amount reinsurer pays per occurrence
• Layer Top: Attachment + Limit

11.2 Loss Allocation

For each simulated annual loss L:

if L ≤ attachment:
    ceded = 0
    retained = L
elif L ≥ attachment + limit:
    ceded = limit
    retained = L - limit
else:
    ceded = L - attachment
    retained = L - ceded

11.3 Reinsurance Metrics

Separate EP curves are generated for both ceded and retained loss distributions.

12. Stress Testing

12.1 Named Catastrophe Scenarios

Each stress scenario modifies the baseline simulation by applying multipliers to frequency, severity, and correlation:

12.2 Stress Simulation

Each scenario runs 5,000 simulations with modified parameters:

stressed_freq(company, peril) = min(0.85, baseline_freq × freq_multiplier)
stressed_severity = min(1.0, baseline_severity × sev_multiplier)
stressed_correlation = scenario.correlation (replaces baseline ρ)

12.3 Stress Outputs

13. Sensitivity Analysis

Approximate impact of parameter changes on AAL using linear scaling:

These are first-order approximations for speed; full re-simulation is used for exact results.

14. Cat Bond Pricing Engine

The Cat Bond tab provides a database of 14 real-world cyber catastrophe bonds from the Artemis Deal Directory, spanning 5 sponsors (Hannover Re, Beazley, Chubb, Swiss Re, AXIS Capital) with 3 distinct trigger mechanisms. Each bond has its own dedicated parameters based on its actual structure.

14.1 Bond Database by Sponsor

14.2 Three Trigger Types & Their Parameters

When a bond is selected, the UI adapts to show only the parameters relevant to that bond's trigger type:

Key design decision: Parametric bonds (Hannover Re / Cumulus Re) are the only bonds where Monte Carlo simulation is used — because your portfolio's cloud provider dependencies directly affect the trigger probability. For indemnity and industry loss bonds, the model uses the sponsor's actual published metrics (EL%, coupon, attachment probability) from the Artemis Deal Directory, since these bonds trigger on the sponsor's entire book (e.g. Beazley's $600M+ cyber losses), not on your portfolio's losses.

14.2 Cost-Benefit Analysis

Each bond selection produces an underwriter-actionable cost-benefit assessment:

14.3 Region Tier Model (Parametric Only)

15. Vendor Model Comparison

How Rankiteo v2.1 compares to commercial cyber risk models:

Key differentiators: Rankiteo is the only platform combining loss exceedance modeling with real-world cat bond pricing from the Artemis Deal Directory, coverage reinstatement modeling (Marsh Cyber ECHO), and excess layer pricing (ILF difference method) in a single integrated underwriting workflow. The integration of 14 real cyber cat bonds with cost-benefit analysis is unique in the market.

Remaining gap vs. vendors: Copula-based correlation (vs. common shock + network propagation) and peril granularity (6 vs. 10+). The supply chain contagion model closes the network propagation gap. Copula and additional perils are planned for v3.0.

16. Backtesting & Validation

The model automatically validates its outputs against published cyber claims benchmarks after each simulation run. Results are displayed in the Model Info bar as PASS/REVIEW.

16.1 Benchmark Sources

16.2 Validation Criteria

16.3 Model vs Benchmark Comparison

16.4 Known Calibration Gaps

• US severity is understated: IBM reports US avg $10.22M but our model uses $4.88M global mean with US region factor 1.0x. The gap is partially captured by lognormal tail (σ=1.0 gives 99th percentile ~$59M), but the mean is low for US-heavy portfolios. Fix: consider US-specific severity means in v3.0.
• Coalition avg ($115K) is much lower: Coalition includes small attritional claims that our model doesn't capture well (BEC at $250K mean is already higher). This reflects that our model is calibrated to “material” claims, not frequency/attritional layer.
• No historical claims backtest: We validate against published aggregates, not against specific historical portfolio losses. True backtesting requires integrating actual claims data from the portfolio, which is a data integration task.

17. Data Sources

18. Limitations & Assumptions

1. Frequency model is Bernoulli: Each (company, peril) has at most one loss event per year per simulation. Multiple events of the same type in one year are not modeled.
2. Independence between perils: Ransomware and data breach are treated as independent events for the same company (though correlated across companies via common shock).
3. Severity capped at 100% of coverage: No single event can exceed the policy limit.
4. Linear sensitivity approximations: Sensitivity analysis uses first-order estimates, not full re-simulation.
5. Static portfolio: The simulation assumes portfolio composition doesn't change during the year.
6. No inflation adjustment: Loss amounts are in current dollars with no trend factor.
7. Deterministic seed: random.seed(42) provides reproducibility but means the same inputs always produce identical outputs.

19. Glossary