For Seminar Attendees Only 1 1 the Next Frontier of Cyber Modeling

Recent Cyber Events

Individual Risk Events Still Drive the Majority of Claims

Systemic Ransomware

Aggregation Beyond the Cloud

Cyber as a Peril (aka Silent Cyber)

Cyber Modeling Platform – Key Enhancements

Estimated insurance loss: USD 350 million

Estimated insurance loss: GBP 75 million

Estimated insurance loss: USD 320 million (to traditional affirmative cyber policies)

GDPR fines Continue to Ramp Up New regulations in the U.S. Amountof Fines(Euros)

month Counts of fines

Counts of fines Source: enforcementtracker.com

month

Business By Country Interruption Frequency

Predictors Correlation by Attack by Attack Vector Vector

Source: IBM/Ponemon

Machine learning helps us understand which potential cyber predictors lead to incidents

Separate predictors for each attack vector scenario

The Local Bakery The Food truck The Coffee Shop

Correlation specific to each attack vector – lost device events have no correlation, while phishing has stronger correlation

•Yes Systemic •No

•Windows Operating system •Mac •Android

•Ukraine Geotargeting •Bosnia •Etc.

•Email Delivery mechanism •Trojan •Database

•Particular vulnerable programs (Adobe, Java, Flash, etc.) Other characteristics •Does it destroy data or just encrypt it? •Has the encryption already been broken?

Vulnerability

Email Downloads Messaging Method Delivery Exploitation

Windows MAC Android Linux

System Operating

Compromised Backups Scareware Payment Destruction

Type Encryption Remediation

Point of Infection Severity (BI) aggregation rate

BI cost experienced SMB V1 Vulnerable 1 Computers (2017): 1 billion 0.8 0.6 NotPeyta impacts: 12.5K 0.4 devices 0.2 Infection rate: 1/80,000 0 0 1 2 3 4 5 6 Day

Manufacturers Browsers Managed Services Operating Systems CDN …are numerous! VPN Providers Email Payment Processors DNS SSL Certificates Infrastructure providers ISP Ad

Manufacturers Browsers Managed Services Operating Systems CDN How severe would an event be?

Email Payment Processors VPN Providers DNS SSL Certificates Infrastructure providers ISP Ad

Manufacturers Browsers Managed Services Operating Systems CDN How frequent would an event be?

DNS SSL Certificates Infrastructure providers ISP

Managed Services CDN How much aggregation would the event have?

DNS

Infrastructure providers ISP

CDN What’s left? Email DNS Infrastructure providers ISP

CDN server

Original server

User

Dynamic Content Region of the Cloud

CDN Routed to nearest Edge Location

User

Cyber Event

Blackout *NEW* Commercial

Fire Depth

Breadth

Fire/No Fire Fire Alarm Control Panel σ 푆푐푒푛푎푟푖표 푁푢푚푏푒푟 (1 - 8)

Damage Function P-factor Building Characteristics

Blackout *NEW* Commercial

Fire Depth

Area of Focus

Breadth

Bad actors are a step ahead

Business interruption continues to be a driver of major losses

Systemic ransomware is a concern

Aggregation risk extends beyond the cloud

Cyber as a peril is here to stay

Flexibility and Comprehensive Cyber Risk Data Transparency Risk Modeling Augmentation

User Data Management Data Enhancement

Includes Cyber Exposure Database

Includes technographic and firmographic data

Reporting Analytics Verisk Cyber Data Standard

Cyber Analytics Cyber Analytics Monitoring and Industry Exposure Database (IED) Loss Engine Reporting

Data Import and Selective Probabilistic Loss Deterministic Validation Backfilling Analytics Loss Analytics

Matching

Cyber Data Sources Data Cyber Algorithms for Exposure Data Augmentation management Scenarios

Server and Database User Interface

Workflow Enhancements Systemic Ransomware Reinsurance Policy Workflows (Web based Interface) (Using Detailed Data) (Support for Single Risk & CAT Treaty)

Loss Reporting by Coverages Global Industry Exposure (Enhanced Financial Modeling for support Database Cyber-as-a-Peril up to 14 business coverages) (Support for 300M+ organizations) (Ability to analyze affirmative & silent cyber exposure for Property, D&O, E&O Loss Breakdown by Attack Vectors Complete Aggregation Models and other Lines) (Single Risk Ransomware, Phishing, Physical (Complete aggregation support for new Tampering etc.) scenarios with catalogs)

Public API Support Enhanced Individual Risk (Loss Analysis workflow support via RESTful Models API’s) (Enhanced GDPR, BI losses & attack Systemic Ransomware vector correlation) (Using Market Share Data)

Summer 2020 (v3.0) Q1 2021 (v4.0) Q4 2021 (v5.0)

Upload Exposures Validate Exposures Configure workflows for company Run Loss Analytics match & data enhancements

Exposure Summary Dashboard Loss Metrics Dashboard Workflow Manager

©2020 Verisk Analytics, Inc. CONFIDENTIAL: For Seminar Attendees Only 41 41 Leveraging Cloud-Native Platform Services AIR Cloud / Public Cloud ARC Platform (Servers and DB) Functions Application UI and API’s Cloud Services Data Management • Identity management • API management

Loss Analytics • Serverless processing Cloud Cloud • Batch processing Cloud Data

Platform Services Platform • Data Warehousing as Platform Services Service (DWaaS) • BI & reporting Elastic Auto-Scaling