Historical loss data can’t keep up with cyber risk anymore. AI is shrinking attack timelines, while shared cloud and software dependencies create hidden single points of failure across entire books of business.
We built Cyence Model 8 to give P&C underwriters, exposure managers, reinsurers, and (re)insurance brokers a more practical way to assess cyber risk. By bringing exposure tracking, single-risk underwriting, portfolio accumulation, and loss analytics together , Model 8 gives you a more complete view of cyber risk, from ground-up exposure to gross loss.
Here’s a closer look at what Model 8 brings to underwriting and portfolio management workflows.
Control Over Your Exposure Inputs
Every commercial portfolio carries a unique risk profile, and relying on broad industry benchmarks makes it hard to price coverage with confidence. Cyence Model 8 gives you control over the data shaping your analysis.
Firmographic data describes the attributes business-to-business (B2B) companies use to classify and segment organizations. If you have it, along with details about endpoint security tools, you can add it directly to the model. The platform resolves technographic data in real time across up to 100 domains per risk. This helps you account for complex corporate structures and international subsidiaries rather than relying on broad, parent-level assumptions.
We also recognize that submission data in the real world is rarely complete. When domain or firmographic information is missing, Cyence Industry Intelligence for portfolio analyses automatically fills in the missing details. This keeps smaller commercial risks moving and enables reinsurers to analyze broad, multi-cedant portfolio submissions without delay.
You can also update risk profiles as conditions change. For example, when an insured upgrades from endpoint detection and response (EDR) to managed detection and response (MDR) or moves to a new cloud provider, you can rerun the assessment to see the immediate impact on modeled loss results.
A Realistic View of Everyday Cross-Entity Correlation
Understanding how cyber risks connect during normal, non-catastrophe loss years has always been a challenge. Catastrophe models help assess extreme events well, but Model 8 adds a view of why everyday attritional losses cluster within specific industries.
Model 8 introduces a three-layer correlation structure for targeted data breach and ransomware events. Rather than treating everyday targeted attacks as entirely isolated incidents, the model tracks shared risk drivers across the three levels:
- Market-wide factors, including global threat actor capabilities, geopolitical activity, and broad defensive trends.
- Sector dependencies, including shared technologies and common target profiles within specific industry verticals.
- Sector-region dependencies, including overlapping regulatory frameworks, regional software adoption, and shared operating practices.
This structure gives you a clear view of cross-entity dependencies fully embedded in our stochastic framework. For example, an active threat campaign targeting a regional sector can trigger a cluster of claims without escalating into a market-wide catastrophe.
Modeling the Dual Impact of AI
AI is changing how attackers operate and how organizations defend themselves. Model 8 reflects both sides of this shift in its loss calculations.
On the offensive side, threat actors use AI to automate network reconnaissance, scan for exposed ports, generate persuasive social engineering lures, and coordinate attacks across supply chains. This increases both the speed and the overall frequency of security incidents.
On the defensive side, security technologies continue to advance. EDR and MDR tools use automation to detect lateral movement and isolate compromised endpoints early. Model 8 factors these controls directly into its loss modeling for both targeted and mass ransomware and data breach events, showing how effective controls reduce loss severity.
Spotting Coordinated Attack Campaigns
Cyber risk rarely fits neatly into isolated single-target breaches or full-scale cyber catastrophes. Many events fall somewhere in between.
Model 8 introduces dedicated modeling for coordinated attack campaigns, reflecting how offensive AI makes it easier for sophisticated threat actors to coordinate attacks against organizations with shared technology dependencies. More broadly, AI’s impact on both offensive and defensive capabilities runs through Model 8, shaping how cyber risk is assessed. To help insurers evaluate these multi-client targeted events, Model 8 incorporates more than 150 sector and sector-region combinations, making it easier to identify hidden accumulation before a cluster of losses hits the balance sheet.
Exposure Signals
Model 8 also expands telemetry with 31 refined Exposure Signals. These signals focus heavily on third-party dependencies, including:
- Infrastructure as a service (IaaS)
- Software as a service (SaaS)
- Content delivery networks (CDNs)
- Web hosting providers and internet service providers (ISPs)
Beyond core infrastructure, Model 8 evaluates active risk indicators such as known exploited vulnerability (KEV) counts, exposed Windows servers, unencrypted email services, and SSL/TLS misconfigurations. Together, these signals help you build a clearer picture of the technology and security factors that shape cyber exposure.
A Dedicated Model for Business Email Compromise
This release also includes a dedicated business email compromise (BEC) model.
BEC remains a primary driver of attritional loss across commercial books, particularly in the small business segment. The model analyzes social engineering techniques and payment workflow manipulation, using revenue-based thresholds to deliver tailored frequency and severity estimates for small and mid-sized businesses.
Granular Financial Analytics
For cyber analytics to be actionable, they must align with how insurers structure policies today. Model 8's financial engine supports complex commercial policy structures with precision.
You can model attachment points, retentions, policy limits, event-triggered sublimits, and specific policy exclusions, such as nation-state attacks, extortion, or non-malicious system failures. For business interruption and contingent business interruption, the platform accounts for monetary deductibles, waiting periods, and franchise deductibles to help translate ground-up risk estimates into reliable net and gross insured loss metrics.
Systemic Software Failure
Not all cyber losses result from malicious attacks. Organizations rely heavily on on-premise software and cloud services to keep critical applications running, and a flawed update or provider outage can take thousands of systems offline at once.
Model 8 addresses these risks with a new Systemic Software Failure model, covering operational outages alongside malicious cyber events. This gives you a broader view of accumulation risk arising from disruptions that can affect multiple insureds simultaneously.
Model 8 also evaluates cloud risk through a hierarchical cloud outage model. The model accounts for both vertical SaaS dependencies (which deeply impact specific industries) and horizontal SaaS dependencies (which spread broadly across sectors), so you can see how a provider outage flows through your portfolio.
Built for Portfolio Scale and Tail-Risk Confidence
Underwriting individual risks requires precision, but managing a global book requires substantial processing power. Model 8 features a stochastic simulation engine that generates 100,000 simulation years, a tenfold increase over our previous engine.
By running attritional and catastrophe models in parallel, the platform converges quickly on extreme tail-risk events. The resulting year-loss tables flow directly through the financial module to yield clear gross loss figures and actionable portfolio intelligence.
A Forward-Looking Partner in Cyber Risk
Cyber risk will keep evolving, and Model 8 gives you an analytical foundation built to adapt with it. Cyence Model 8 helps you navigate emerging cyber threats with clarity and confidence.
Join us at 8:30am GMT on Nov. 9 at The Old Library, Lloyd's of London, for the Guidewire Cyence London Market Event. You’ll see live demonstrations of Model 8, connect with our analytics team, and discuss how these analytics apply to your portfolio. You’ll also have the opportunity to connect with peers from across the London and international specialty markets to discuss the future of cyber risk management. Register now.