사이버 공격의 폭발적 증가를 맞은 보험사
사이버 공격 급증에 맞서 보험사들이 반응형에서 예측형 방어로 전환한다.
The call came at 2:14 in the morning.
Miriam Voss saw the number on her phone’s screen — the company’s internal alert line — and knew before she answered that sleep was over, not just for tonight.
“Forty-three claims in the last six hours,” said the voice on the other end. It was Theo Park, her head of claims operations, and he was whispering the way people whisper when a number is too large to say at full volume. “All ransomware. All in the manufacturing vertical. Miriam, the aggregate exposure is — ”
“Don’t say it on the phone,” she said. “I’m coming in.”
Outside the window of her apartment, the city of Chicago was still. It was a Tuesday in early autumn, and the trees on the street below had barely begun to turn. She stood for a moment, looking at them, before pulling on her coat and walking out the door.
Sentinel Re had been writing cyber insurance for eleven years. In that time, it had grown from a curious side line — the product that older underwriters called “that internet policy” — into the company’s largest revenue segment. The business was good. It was also, as Miriam had warned in every quarterly risk review for the past three years, fragile in ways that standard actuarial science was not designed to detect.
The problem with cyber risk was that it was not like fire, or flood, or even pandemic. Those catastrophes moved at human speed. A wildfire needed fuel and wind. A virus needed bodies in proximity. But a ransomware campaign could scale to ten thousand victims in the time it took an underwriter to eat lunch, and the thing that made it dangerous to one insured made it dangerous to all of them at once, because they all ran the same software, lived behind the same vulnerable protocols, trusted the same third-party vendors.
Miriam had a word for this. She called it the correlation problem, and she had been writing memos about it since 2022. The memos were thorough. They were well-argued. They sat in a shared folder that senior leadership visited the way one visits a dentist — occasionally, reluctantly, and not long enough.
The forty-three claims were the dentist arriving at the house.
By the time she reached the office, Theo had the numbers on the wall. The claims had come from a coordinated intrusion campaign that had swept through a cluster of mid-sized industrial manufacturers across the Midwest. The attackers had moved laterally through a shared logistics platform — a software vendor that twenty-one of Sentinel Re’s clients used to manage their supply chains. One door. Twenty-one rooms.
“We had single-vendor concentration flagged on six of them,” Theo said, not meeting her eyes. “The other fifteen came in under the threshold.”
Miriam stood at the display and did the arithmetic without a calculator. The aggregate potential payout, assuming standard ransomware response costs and business interruption coverage, was somewhere between sixty and ninety million dollars, depending on how quickly each client’s IT teams could restore operations. That was three times the reserve she had been authorized to hold against a single-event scenario in this vertical.
Down the hall, the CFO’s office light was on.
Daniel Howe appeared in her doorway twenty minutes later with two cups of coffee and the expression of a man who had already called the reinsurance broker and had not liked the conversation.
“Tell me the range,” he said.
She told him.
He sat down. He did not say anything for a moment, and the silence in the room had a particular quality — the silence of a person recalculating everything they thought they knew about their own company.
“The model said the ninety-ninth percentile loss for a single event in manufacturing was thirty-one million,” he finally said.
“The model was built in 2021,” Miriam said. “Before the logistics software market consolidated. Before half the country’s mid-market manufacturers started running on four vendors instead of forty. The model assumes independence. The real world doesn’t have it anymore.”
She had said this before. She had said it in the memos. She said it again now not to be right, but because the only way through was through.
The next seventy-two hours were a controlled collapse. Claims continued to arrive — not all ransomware now, but a broadening wave of network intrusions, data exfiltration events, and business email compromise cases that had apparently been waiting in the pipeline, un-reported, for weeks. The industry had been watching loss ratios climb all year. Global cyber insurance payouts had already breached thresholds that several major reinsurers had declared theoretical just eighteen months prior. Sentinel Re was not alone in this. It was not even among the worst exposed. But knowing that a bus has hit several other people before reaching you provides limited comfort at the moment of impact.
Miriam moved her team into the glass-walled war room on the fourth floor and did not leave it for the better part of three days. She ate sandwiches from the lobby café and slept on a couch that someone had dragged in from the break room and which smelled faintly of old coffee. The rest of her team did the same. They triaged. They documented. They called policyholders, and they listened to voices on the other end that were sometimes angry, sometimes frightened, and sometimes so exhausted they barely spoke at all.
A plant manager in Rockford. An operations director in Toledo. A CFO in Cincinnati who had been on the phone with her IT vendor for thirty-six hours and was crying, quietly, while she gave Miriam the damage estimates.
These were the moments that did not appear in the risk models. The models measured dollars. They did not measure the sound of a person crying on a Tuesday night because the company her father had built over forty years was dark and silent and she did not know when it would come back.
On the fourth day, Miriam walked into Daniel’s office and told him what she wanted to do.
She had spent the previous night — the hours between three and five in the morning, when the claims queue had finally, briefly, quieted — writing a document. Not a memo. A plan.
The company had been reactive for eleven years. It had taken risk, priced risk, and paid claims when the risk materialized. That was the insurance business. That was how it worked. But the environment had changed in ways that made the classic model not merely imprecise but structurally wrong. You could not price uncorrelated risk when the risk was deeply correlated. You could not hold adequate reserves for a single-event scenario when single events were now ecosystem events. And you could not continue to treat the question of whether a client would be attacked as an actuarial abstraction when the answer was increasingly: yes, and probably soon.
What Miriam proposed was a different model. Not insurance as a financial product, but insurance as a posture. Sentinel Re would partner with a threat intelligence firm — she had three candidates already identified, had been quietly talking to them for months — and would begin building predictive risk scores for every policyholder in its book. Not historical frequency. Not industry vertical averages. Live signals: patch levels, vendor exposure, employee behavior, dark web mentions of the client’s infrastructure. The score would update continuously. The premium would follow the score.
Clients who improved their posture would pay less. Clients who let their posture deteriorate would pay more, or be offered remediation services as a condition of renewal. The company would stop being a payer of last resort and start being, in some sense, a participant in the defense.
Daniel listened without interrupting. When she finished, he looked out the window for a long time.
“The regulators will have questions,” he said.
“Yes.”
“The policyholders will push back on dynamic pricing.”
“Some of them. Others will find it fair.”
“And if the threat intelligence is wrong? If we score a client as low risk and they get hit anyway?”
Miriam looked at him. “Then we pay the claim. Same as we do now. The difference is we’ve tried.”
Another silence. Outside the window, a cloud moved across the sun and the light in the office changed.
“How long to stand up the pilot?” Daniel asked.
“Eight months if we move fast. Twelve if we’re careful.”
“What’s your recommendation?”
She thought about the CFO in Cincinnati, crying quietly while the numbers came through. She thought about the forty-three claims on the first night and the ones that had come after and the ones that were, statistically, already forming somewhere in the dark — in some server room, in some code repository, behind some vendor portal that too many of her clients trusted too completely.
“Move fast,” she said. “And be careful.”
The war room was quieter now. The acute wave had passed, though the work of the claims would continue for months. Miriam stood at the window on the fourth floor, looking down at the street below. The trees had turned while she wasn’t watching. The city was the same city it had been a week ago, but something in the air had shifted — the cool particular quality of a season that has decided to change.
She thought about the risk model that had failed. She thought about what would replace it.
She did not know if the new approach would be enough. She did not know if the threat would continue to accelerate faster than any defense could adapt, if the attackers would always find the next unlocked door before the defenders could close it. She had spent her career in a discipline built on the certainty of uncertainty, on the quantification of what could not be controlled. Perhaps that was still true. Perhaps the most honest thing an insurance company could be was a companion in uncertainty rather than a cure for it.
She picked up her phone. There were seventeen unread messages, two reinsurance calls to return, and a document to finalize before morning.
She started with the document.
본 글은 정보 제공 목적이며 투자 권유가 아닙니다.