Read the Bank of England’s account of SIMEX26 the way an underwriter would. On October 8, 2026, the UK’s Cross-Market Operational Resilience Group ran its biennial crisis exercise on a single scenario — a global disruption to cloud-based services — with the thirty-eight largest and most systemically important banks and market infrastructure operators in the room, and a live sitting of the sector’s business continuity group on top. One event. Thirty-eight balance sheets, simultaneously. That is not a drill detail. That is an accumulation chart, drawn by the regulator.
The exercise was about finance, but the exposure it rehearsed belongs to every broker with a cyber book. The same small group of cloud and SaaS providers sits underneath thousands of your insureds at once, across every industry you write, with no geography to fence it in. SIMEX26 is what that sentence looks like when a central bank stages it.
Aggregation without a map
Property catastrophe aggregation is manageable because it has an address. A hurricane crosses a coastline; the carrier knows its zip codes. Cloud aggregation has no coastline. As Megan North, executive vice president and branch leader at Amwins, put it in recent market reporting: “The same large providers sit behind a heavy, heavy portion of our insureds.” One attack or outage at a major technology provider can disrupt thousands of businesses at the same time, generating claims across numerous accounts — and carriers concede they cannot fully see how much exposure they are accumulating policy by policy, because the dependency lives two or three vendors deep inside each insured.
The loss data is moving the same direction. Verizon’s 2026 Data Breach Investigations Report found third parties involved in 48% of analyzed breaches — a 60% increase on the prior year’s dataset. Verizon counts that as the share of breaches with third-party involvement: a vendor-product flaw, data hosted at a vendor, or a vendor connection.
The price says soft. The terms say scared.
Here is the part to say plainly to clients, because the renewal quote will not say it for you: the cyber market’s price signal and its risk signal currently point in opposite directions. US cyber rates fell 2% in the second quarter of 2026, per Marsh’s Global Insurance Market Index — the same decrease as the quarter before, in a run of falling rates that stretches back to the second quarter of 2023, while global cyber rates fell 4% for a twelfth consecutive quarter of reductions. Capacity is abundant. Competition is intense. Cyber has been running on its own cycle for three years now, decoupled from property and casualty — the split we mapped in why the cycles don’t move together.
And at the same time, carriers are quietly rebuilding the walls. North describes insurers introducing widespread-event exclusions and restricting dependent business interruption coverage precisely to manage failures at critical technology providers — in her words, putting “guardrails on what they’re willing to cover and how much of that risk they’re willing to carry on their books.” Rather than raising prices on dependent-heavy accounts, carriers are asking more questions and limiting the capacity they will expose to the risk. The premium line is the last place this correction will show up. The exclusions page is where it already has.
Dependent business interruption is where it lands
The coverage that answers a SIMEX-shaped event is dependent (contingent) business interruption — the grant that responds when a covered incident at an outside technology provider stops your insured’s operations. It is also the grant now being sublimited, or repriced as a buy-back to full limits, account by account. An insured can renew at a lower premium, in a soft market, and quietly hold a fraction of the outage protection it had last year — discovering the sublimit for the first time on the morning its cloud region is down along with everyone else’s.
The contract underneath will not rescue them either. Vendor agreements with the major providers typically cap liability and indemnify in the provider’s favor. As North puts it: “Outsourcing the function doesn’t outsource the risk.” The insured assumed the contract protected them; the coverage was the protection — and the coverage is the thing being narrowed.
The conversation to have before the renewal, not after the outage
Brokers cannot diversify the internet for a client. What they can do is make the dependency visible while there is still time to price it honestly. Four items, in the order a client conversation actually goes:
Draw the map. Which providers, if down for a day, stop the client’s revenue? Not the vendor list from procurement — the short list of systems whose outage halts operations. Underwriters are now asking exactly this, and the account that arrives with its map drawn gets underwritten on facts instead of flagged on suspicion.
Read the DBI grant like a claims adjuster. Sublimit or full limit? What waiting period? Does a widespread-event exclusion swallow the very outage the grant exists for? These are this year’s renewal deltas, and they will not be in the broker’s summary unless the broker puts them there.
Bring the compensating-controls answers. Underwriters examining third-party risk are looking at network segregation, restrictions on vendor access into the insured’s environment, and what the insured can keep running manually or elsewhere. “We’ve gotten hyper-focused on shoring up our insureds’ own systems,” North says — the questions have moved to the vendors’ doors into those systems.
Say the soft-market sentence out loud. Your rate went down. Your outage coverage may have gone down further. A client who hears that from their broker in October renews on the real program; a client who hears it from an adjuster in an outage has a different conversation — with a different broker next year.
Our sister desk at Continuity Hub works the same exercise from the practitioner’s side — what a sector-wide rehearsal proves that no single firm’s failover test can — and for the index-trigger mechanics that make parametric structures one answer to correlated outage risk, see our explainer on parametric insurance and index-based risk transfer.
Why a UK bank drill belongs in a US broker’s renewal file
Because regulators have started rehearsing the correlated event as a when, not an if — and carriers are terming for it in the current renewal cycle, in the fine print, while the headline rate falls. The firms in that London room were told, in print, that their regulator now expects action. Your clients will get no such letter. They have you, the dependency map, and a dependent business interruption grant that deserves a fresh read before the morning it matters.