Cyber risk modelling has advanced significantly in recent years, yet blind spots remain. One of the most material: multi-client targeted attacks (MCTAs) – highly coordinated cyber events affecting a small number of organisations, but with disproportionately severe financial impact – be it business interruption, data breach or both.

In collaboration with AXIS, Gallagher Re, and Moody’s, Munich Re has contributed to a new white paper under the Cyber Industry Steering Group (ISG) to address this “missing link” in current cyber catastrophe frameworks.

Traditional cyber models focus on large-scale systemic events such as widespread malware or cloud outages. However, they often underrepresent smaller-footprint, high-severity attacks – even though these events can materially impact portfolios and earnings.

For insurers and reinsurers, this gap can lead to:

• Incomplete risk quantification
• Suboptimal underwriting and portfolio decisions
• Increased exposure to unexpected loss accumulation

This joint publication provides a structured view on:

• What defines MCTAs and how they differ from traditional cyber events
• Key drivers of correlation, including technology vulnerabilities, threat actor strategies, geopolitical factors, and market dynamics
• Challenges in modelling, including data scarcity and complex event permutations
• Implications for portfolios, from niche concentrations to diversified books

It also outlines why integrating MCTAs into modelling approaches is essential to achieving a more complete and resilient view of cyber risk.

At Munich Re, we believe advancing cyber risk understanding requires industry-wide collaboration. Through our engagement in the Cyber Industry Steering Group, we are working with partners across the value chain to strengthen analytics, improve modelling frameworks, and support the sustainable growth of the cyber insurance market. The concept of MCTAs is already on our experts’ mind for some time and Munich Re introduced it in our internal modelling landscape in 2024. Collaboration within the Cyber Industry Steering Group enabled us to share insights and aspects on MCTAs both within and beyond the project. With the paper, the authors hope to stimulate further market dialogue.

Gain deeper insight into one of the most overlooked drivers of cyber loss. Download the full report: “Multi-Client Targeted Attacks: The Missing Link of Cyber Catastrophe Models”.