Digital Dominoes: Scanning the Internet to Expose Systemic Cyber Risk

## Overview

In this talk, Morgan Hervé-Mignucci, head of cyber catastrophe modeling at cyber insurer Coalition, addresses the escalating problem of systemic cyber risk—cascading failures across deeply interconnected digital supply chains. Citing major disruptions within the previous 18 months—including Change Healthcare (paralyzing the US healthcare billing system), CDK Global (disrupting up to 15,000 North American auto dealerships), and CrowdStrike (grounding widespread airline traffic)—the presentation highlights how single software platforms or vendors become "digital dominoes."

The speaker draws a crucial distinction between traditional insurance-centric **cyber catastrophe ("cyber cat") modeling** and true **systemic cyber risk**: - **Cyber Cat Modeling:** Focuses specifically on portfolio loss quantification and financial solvency for an insurer's book of business, typically using third-party vendor models. - **Systemic Cyber Risk:** Covers economy-wide, industry-wide, and societal disruptions, extending far beyond insured entities and dollar claims to inform national security and public policy.

## Evolution of Cyber Exposure and Reactive Interventions

The digital economy's deepening interconnectedness has created acute fragility. The talk traces a historical timeline of supply chain and systemic incidents: - **Foundational Attacks:** Target breach (supply chain entry), Sony and Ukraine power grid attacks (targeted attacks), WannaCry and NotPetya in 2017 (protocol- and update-level exploits). - **Recent Vectors:** SolarWinds in 2019 (compromised DLL in trusted updates), Microsoft Exchange vulnerabilities (broad enterprise exploitation), Log4j (open-source Java library dependency), and CrowdStrike (demonstrating that systemic disruption can be non-malicious).

Both insurance and public policy responses have functioned as lagging, reactive indicators: - **Cyber Insurance Measures:** Shifted to affirmative policy language, specific sub-limits (e.g., ransomware payouts), strict underwriting controls (mandating EDR, MFA, and verified backups), continuous network scanning over static questionnaires, and reinsurance risk transfer. - **Public Policy Actions:** Implemented SEC 8-K disclosure rules, CISA/NIST baseline guidelines, government infrastructure takedowns, major regulatory fines (e.g., Equifax, OFAC ransomware enforcement), Executive Order 14028 driving SBOMs, CIRCIA, TSA pipeline/railroad directives, and frameworks like DORA.

Despite these efforts, economic losses continue to dwarf insurance payouts, exposing a massive societal "protection gap."

## Flaws in Traditional Cyber Cat Models

Traditional cyber cat models borrow heavily from natural catastrophe (NatCat) frameworks (e.g., hurricane modeling), relying on simulated probabilistic loss curves. Hervé-Mignucci outlines three major flaws: 1. **Core Misalignment:** NatCat models assume physical, non-adversarial processes. Cyber risk is dynamic, rapidly evolving, and adversarial, with no real-world "Category 5 digital hurricane" baseline having validated existing vendor models. 2. **Narrow Blind Spots:** Cat models analyze only the insured organizations within a portfolio ("the tip of the iceberg"), completely omitting uninsured societal and economic dependencies. 3. **Vendor Inertia and FUD:** Early commercial models relied heavily on fear-driven, extreme scenarios. Because these models are now embedded in executive and regulatory compliance processes, vendors face little commercial incentive to refine or reduce unwarranted worst-case assumptions.

## Internet-Scale Dependency Graph Methodology

To accurately quantify systemic exposure, Coalition implemented a data-driven approach based on continuous internet-scale network measurements: - **Dependency Graph Mapping:** Treats systemic cyber risk as a massive dependency graph of "aggregation technologies and vendors" (ATVs). - **Known-Asset Focus:** Eliminates hypothetical guesswork behind firewalls, mapping only empirically verifiable, outside-in internet-facing dependencies. - **Granular Asset Fingerprinting:** Rather than assuming all cloud usage is identical (a major flaw of legacy models that treat every AWS customer equally), the methodology fingerprints fine-grained organizational dependencies down to specific cloud regions and services (e.g., isolating AWS US-East-1 running Athena for dynamic pricing versus an entire provider). - **Scale and Application:** Evaluates individual company digital footprints continuously at an internet scale spanning millions of organizations to surface concentrated points of failure across key sectors of the US economy.