Kindynos — Event Intelligence
Home / Evidence / INS-03 — Policy terms transform one cyber-loss scenario into insured and retained consequences
Evidence artifact

INS-03 — Policy terms transform one cyber-loss scenario into insured and retained consequences

Evidence document rendered as a website page.

Back to evidence

INS-03 — Policy terms transform one cyber-loss scenario into insured and retained consequences

Event — CYBER_CAT_EVENT (GLOBAL_INSURANCE_V3, engine10, seed 42). Incident amounts are declared scenario inputs authored on the policy asset (badged, source-referenced: Marsh/Aon tower sizing; IBM Cost-of-a-Data-Breach 2024; Sophos/Coveware).

Starting state — an insurer writes CYBER_INSURANCE_POLICY: $250M aggregate, $100M per-claim, $5M self-insured retention; sublimits BI $50M, extortion $10M, PII $100M, regulatory $0 (the commonly-excluded coverage, authored as a real zero sublimit).

What changed — four chronological declared incidents: BI $60M, extortion $9M, PII breach $25M, regulatory $15M.

Who bears the consequence — the waterfall (retention → sublimit → per-claim → aggregate, consumed chronologically): insurer pays $50M + $4M + $20M + $0 = $74,000,000; insured retains $35,000,000; aggregate not exhausted. The engine10 F8 row values the insurer book at −$74,000,000 — matching the hand computation to the dollar.

Key numbers — pays $74M / retains $35M; regulatory head pays $0 by authored sublimit.

Boundary — scenario-level valuation: the fired event does NOT dynamically generate the incident amounts (future authoring channel); no waiting-period/coinsurance/war-exclusion mechanics; no cyber reinsurance; koprisk calibration self-declares illustrative.

Evidence status — VERIFIED_AFTER_REPAIR (owner ruling I-2); rerun on freeze commit c3229eed7ed268d9677ce2a7333ecd4417e5fa42, in-process and live-HTTP identical.