The Peril in Plain Sight

A risk everyone carries, no one has priced, and reinsurers no longer take back.

1. Where the Market Stands, and What It Is Quietly Carrying

Global affirmative cyber premium reached USD 15.0bn in 2025 and Swiss Re projects USD 16.4bn in 2026, rising to USD 17.1bn in 2027. Cyber still sits at under 1% of global P&C premium. The overhang, silent (non-affirmative) cyber, is unpriced exposure embedded across property, casualty, marine, D&O, crime and specialty wordings written before affirmative cover existed.

The exposure, in numbers the market already knows:

• The loss that already happened: PCS attributed close to 90% of the USD 3.3bn NotPetya insured loss to silent cyber; Merck alone recovered USD 1.4bn plus after a seven-year coverage dispute settled in 2024.
• The loss still waiting: Guy Carpenter and Kovrr estimate USD 12.5bn of latent silent cyber loss potential in the US commercial property book alone; global exposure is materially higher when marine, energy and casualty are added.
• The mandate half-adopted: Lloyd's Market Bulletin Y5258 (effective 1 Jan 2020, phased through 2021) mandated affirmative or excluded cyber on first-party property; adoption across delegated authority binders and non-Lloyd's paper remains uneven in 2026.
• The reserves already bleeding: AM Best flagged USD 2.0bn of further adverse reserve development on US commercial liability in 2025 alone; un-remediated silent cyber sits inside those triangles without a peril code.
• The demand-supply gap: Munich Re's 2026 Cyber Survey shows 87% of C-suite respondents concerned about cyber, yet only 37% of exposed firms are buying affirmative cover, sustaining reliance on the silent tail.

2. The Cost of Doing Nothing, Measured Precisely

One systemic event, a hyperscaler outage, a repeat NotPetya, a cyber-physical attack on energy or shipping, converts a dormant wording problem into a cross-line adverse development event that no reserve triangle anticipates.

• An IBNR blindside: a single global event on the scale of NotPetya, inflated 2.5x by nine years of exposure growth, implies USD 8-10bn of unreserved industry loss hitting reserves overnight.
• A ceded book that no longer cedes: CL380 and LMA5400/5401 sit in most treaties; misaligned primary wordings leave carriers with 100% net retention on losses they never priced.
• Rating agencies asking harder questions: AM Best, S&P, PRA and NAIC now probe silent cyber in ORSA and ERM reviews; unquantified exposure translates directly into higher required capital and downgrade risk.
• A courtroom tail with no end date: the Merck v ACE precedent (USD 1.4bn) has emboldened plaintiff counsel; every unresolved silent cyber claim now carries a five to seven year legal-cost tail.
• Three strategic doors closing at once: unremediated books cannot access ILS capacity, cannot be cleanly sold, and cannot support affirmative growth.

3. A Category-Defining Opportunity for Services Firms

For a Tier 1 global carrier with a 15 to 20 year policy archive of 5 to 8 million wordings across 40 plus lines, remediation is an 18 to 24 month, USD 25 to 45m program spanning underwriting, actuarial, claims, reinsurance and compliance. The addressable services market across the top 50 global carriers, top 20 reinsurers and the London delegated authority market is USD 1.8 to 2.4bn over the 2026 to 2028 cycle.

• Reading the book at machine speed: NLP-led mining of 5 to 8 million policy documents, endorsement libraries and treaty slips at USD 6 to 10m per Tier 1 carrier.
• Wiring peril codes into the core: exposure re-tagging in policy admin (Duck Creek, Guidewire, in-house PAS) plus actuarial cube reload at USD 8 to 12m of platform work per program.
• Reconnecting the ceded chain: reinsurance treaty realignment and cession engine rework at USD 4 to 7m, with a recurring ceded reinsurance analytics annuity of USD 1.5 to 2.5m per year.
• Building the evidence file regulators will ask for: ORSA, Form F, PRA SS4/17 and NY DFS 500 documentation at USD 2 to 4m of governance and audit trail work.
• Owning the delegated authority estate: MGA and coverholder attestation platform, cross-market, at USD 40 to 60m across the London delegated authority market alone (Lloyd's plus company market).

4. Four Levers That Bend the Cost Curve

A four-lever program sequenced across 18 to 24 months. Each lever is quantified against a reference USD 25m program economics baseline.

Lever 1: One Wording Truth Across Every Line

A single wording taxonomy across all lines, aligned to LMA5400/5401, CL380, IUA 09-081, and the affirmative cyber SKU set. Reference programs at two European composites cut wording variants by 62% and reduced coverage dispute frequency by 28% within 12 months.

Lever 2: Rebuild the Rails That Carry the Risk

Peril codes, exposure fields and cession rules rebuilt end to end across PAS, actuarial data warehouse, treaty system and claims workbench. Benchmark cost USD 8 to 12m; benchmark IT run-cost saving of 18 to 22% on the ceded reinsurance stack alone.

Lever 3: Put AI Where the Analysts Used to Sit

Fine-tuned LLM classifiers over the wording corpus achieve 92 to 96% F1 on peril detection at pilot scale, versus 70 to 75% for keyword rules. Human in the loop review cuts wording analyst effort by 70 to 80%, taking the per-wording cost from USD 45 to 60 down to USD 8 to 12.

Lever 4: Right-Shore What Remains, at a Fifth of the Cost

Post-AI residual review, treaty mapping and evidence-file production move to India, Poland and the Philippines. Blended rate USD 28 to 35 per hour against onshore USD 145 to 190, a 78 to 82% arbitrage. Applied to a 60,000 hour remediation queue, right-shoring alone releases USD 6.5 to 9.0m from the program budget.

What actually moves to India, workstream by workstream:

• Wording review (highest offshore intensity): clause tokenisation, silent cyber tagging, human-in-the-loop LLM validation, endorsement library curation, exception queue triage, quality assurance sampling. Onshore anchor is limited to legal sign-off and ambiguous-clause escalation.
• Treaty realignment (moderate offshore intensity): treaty slip digitisation, clause-to-cedant mapping, cession-rule test cases, bordereaux reconciliation and evidence pack assembly. Onshore anchor stays with reinsurance broker negotiation, actuarial sign-off and treaty counsel.
• Platform reengineering (high offshore intensity): PAS configuration, peril code extension, ETL and data warehouse build, treaty system integration, regression testing, cutover rehearsals and hypercare. Onshore anchor is enterprise architecture, security review and vendor product management.
• Governance and evidence (moderate offshore intensity): ORSA and Form F documentation drafting, control library build, audit trail assembly, model risk documentation, regulator response packs. Onshore anchor stays with the Chief Risk Officer, appointed actuary and external audit interface.

Where the money goes, before and after AI and right-shore (USD m, Tier 1 reference):

Basis: right-shore percentages reflect the share of workstream effort executable from India-led delivery centres (bilingual, Lloyd's-graded, actuarial-support capable). Conservative reflects current market-adopted offshore ratios at Tier 1 carriers (2024 to 2026 benchmarks). Moderate reflects the achievable ratio once the AI-assisted workbench is in production. Cost reduction on the offshored portion is held constant at 80% (blended USD 30/hour versus onshore USD 165/hour), consistent with 2026 EY, Accenture and TCS insurance BPO published rate cards.

Net effect: total program cost falls from USD 37.5m baseline to USD 11.8m (conservative) or USD 8.5m (moderate), a 69% to 77% reduction, while compressing the timeline from 30 to 18 months.

Right-shorable activities at sub-process level:

Wording review

• Clause extraction and tokenisation across scanned and native PDFs, running the ingestion pipeline that feeds the LLM classifier queue.
• Silent cyber peril tagging and dual-review adjudication, with a second-reviewer QA layer sampling 10 to 15% of every batch.
• Endorsement and schedule library curation, including cross-referencing endorsement chains to the base wording and flagging orphan clauses.
• Exception queue triage where the model confidence falls below threshold, routed to bilingual senior wording analysts in India.
• Comparative wording benchmarking against LMA5400/5401, CL380 and IUA 09-081 templates, producing the gap register for legal sign-off.
• and others (redline drafting support, coverage-map production, MI reporting, historical claims-to-wording linkage).

Treaty realignment

• Treaty slip and wording digitisation from PDF and email archives into a structured treaty repository with version control.
• Clause-to-cedant mapping matrices, producing the traceability grid that shows which cedant policies feed which treaty layer.
• Cession-rule test-case authoring and regression execution against historical claims to prove recoverability under revised wordings.
• Bordereaux reconciliation, cleansing and re-submission to reinsurers, including exception handling on peril codes and territory splits.
• Evidence pack assembly for reinsurer negotiation cycles, including loss-experience extracts and exposure re-tag summaries.
• and others (retro program mapping, commutation data prep, treaty accounting reconciliations, broker query response).

Platform reengineering

• PAS configuration for new peril codes, exposure fields and endorsement templates in Duck Creek, Guidewire and in-house cores.
• ETL, data warehouse and actuarial cube reload, including source-to-target mapping, reconciliation scripts and lineage documentation.
• Integration builds between PAS, treaty system, claims workbench and reinsurance ledger, with API and message contract testing.
• Regression and end-to-end test execution, including automated test suites, defect triage and UAT support pods.
• Cutover rehearsals, data migration dry runs and hypercare operations covering the first 60 to 90 days post go-live.
• and others (environment management, batch job monitoring, release engineering, non-functional performance tuning).

Governance and evidence

• ORSA and Form F narrative drafting, including exposure quantification tables, scenario write-ups and management action logs.
• Control library build and control-testing evidence assembly, mapped to Solvency II, NAIC and NY DFS 500 requirements.
• Audit trail assembly from workflow logs, model outputs and reviewer decisions, packaged for internal audit and external examiners.
• Model risk documentation for LLM classifiers, including validation reports, performance monitoring and drift-detection evidence.
• Regulator response pack preparation for PRA SS4/17, NAIC Model Bulletin queries and Lloyd's Y5258 attestation requests.
• and others (policy and procedure updates, training material creation, board pack drafting, regulator query log management).

5. What This Buys the Balance Sheet

• Reserves that finally hold: quantified silent cyber IBNR moves from unknown to a bounded number in the ORSA, typically 1.5 to 3.0 combined ratio points of tail-risk released.
• Ceded protection that actually pays: aligned wordings recover 85 to 95% of ceded protection currently at risk of non-recovery; on a USD 500m ceded book this is USD 40 to 75m of secured recoverables.
• A cheaper capital story: rating-agency capital relief of 30 to 60 basis points on cost of capital observed at carriers that documented remediation to AM Best and S&P in 2024 to 2025.
• Growth doors reopened: cleaned books unlock affirmative cyber cross-sell (Munich Re SME cyber take-up under 20%, TAM greater than USD 8bn) and ILS-eligible capacity.
• A higher price on the way out: remediated portfolios have transacted at 0.15 to 0.25x book value premium in 2024 to 2026 M&A comparables (Aon, RenRe, Fidelis reference deals).

6. Move Now or Arrive as a Subcontractor

The window is 12 to 18 months. Regulator focus, rating-agency questioning and the next systemic cyber event will decide which firms lead this category and which arrive late as subcontractors.

• Plant a flag in 60 days: publish a defensible point of view that benchmarks reserve exposure, wording variance and treaty misalignment for three named carrier archetypes.
• Prove the thesis in 90 days: package a fixed-fee POV at USD 750k to 1.2m, ingesting 250,000 wordings, producing silent cyber peril tags and a documented ROI conversion path.
• Stand up the delivery muscle before the RFPs land: 40 to 60 FTE bilingual wording analysts and actuarial support pod in India and Poland, Lloyd's-graded quality gates, live by Q1 2027.
• Own the ecosystem before competitors do: lock partnerships with Kovrr, CyberCube, Guidewire and Duck Creek; category leadership is decided by data plus platform reach, not slideware.
• Change the room you sell into: pitch the CFO and CUO, not the CIO. The framing is priced, ceded, reserved and rated, not detection or compliance, and the program is funded from capital, not IT opex.