Risky Science Podcast · Risk Market News

Cyber Risk in 2026 and Why Near Misses Matter More Than Losses With Morgan Hervé-Mignucci

·42 min·2 clips

Morgan names verification systems, credit-rating systems, and payments as the cyber functions most likely to create systemic losses.

1. Risky Science Podcast frames cyber risk in 2026 as a systemic problem that remains poorly understood when losses actually materialize. 2. Chris Westfall interviews Morgan Hervé-Mignucci, head of risk modeling at Coalition, a major cyber insurance writer, because his team works on portfolio analytics, cat modeling, and reinsurance opportunities. 3. The episode asks what a truly systemic insured cyber loss would look like and whether markets are prepared for it. 4. Morgan says commercial cyber models are no longer in their infancy and are now at roughly “iteration seven or eight,” depending on the vendor. 5. He describes two frequency philosophies: extrapolating from the small history of catastrophic events, or building a broader threat-landscape model with many assumptions. 6. Morgan says severity modeling has advanced the most because the industry can map real-world events into policy language rather than start from scratch. 7. For accumulation, he contrasts top-down models based on industry, geography, and company size with bottom-up models built around shared technologies and vendors. 8. He says one industry problem is that some legacy scenarios are no longer realistic because the internet today is very different from the internet 10 or 20 years ago. 9. Morgan also criticizes “crying wolf” approaches and says modeling should stay grounded in what is technologically and economically feasible. 10. He says cloud modeling still faces lagging economic assumptions and too many “heroic assumptions” in the market. 11. Morgan describes his team’s internal approach as mapping individual risks to cloud providers, workloads, and aggregation points so the portfolio view does not miss hidden concentrations. 12. He says bad shortcuts can produce numbers that fail the “sniff test,” especially when aggregated models are not supported by micro-level analysis. 13. When Chris asks about 2026 themes, Morgan highlights industry SaaS and supply chains, citing CDK Global, Change Healthcare, and a Jeep Land Rover supply-chain attack in the UK. 14. He says he worries more about attacks on resilient but widely used industry systems than about a big cloud outage or ransomware on a large cloud provider. 15. Morgan says he dislikes the term “near misses” because it often describes outages that were only reflections of how resilient the services already were. 16. He argues that many cloud disruptions should be interpreted as stress tests, not proof that a larger insured catastrophe was imminent. 17. On the most systemic risk, Morgan points to financial services, legal services, verification systems, credit-rating systems, and payments as cross-industry dependencies. 18. The conversation stays interview-driven and technical, with Westfall pressing for examples and Morgan answering in a measured, practical tone. 19. Listeners interested in cyber insurance, reinsurance, cloud concentration, and systemic risk will get the most value from this episode. 20. Listeners looking for consumer cybersecurity tips or a simple attack story may not find this the right fit.

As heard by us

A patient look at how cyber risk hides in the gaps between exposure, modeling, and insured loss.

Cyber risk is treated as an underwriting and modeling problem, with cloud concentration, hidden dependencies, near misses, and the harder question of what a truly systemic insured loss would look like.

Read the full review in PlayNext →

Why you'd press play

You want the cyber-loss question taken apart by the person who models it.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Risky Science Podcast