Rethinking Cyber-Risk as Traditional Models Fall Short

This article argues that current systemic cyber-risk models are insufficient—being too retrospective and modeled after natural catastrophes—and urges a more proactive, data-driven approach that accounts for vendor and supply-chain interdependencies, localized impacts, and overlooked high-centrality vendors to better predict cascading disruptions and inform insurers and policymakers.