Cyber catastrophe modeling for DyGIST: Moody's enhanced Event Response capabilities for cyber

Authors: Edwina Lister, Director - Risk Management, Moody's; Harry Lawrence, Associate Director - Customer Success Management, Moody's; Afsar Ali, Director - Product Management, Moody's

As the insurance market prepares for the U.K. Prudential Regulation Authority (PRA) Dynamic General Insurance Stress Test (DyGIST) exercise in early May 2026, cyber sits alongside windstorm, flood, and other natural perils as a potential scenario.

For many insurers, modeling a cyber catastrophe under time pressure will be a new challenge. Moody's is ready to help.

An evolution for event response

Following our delivery of stochastic event selections for the Amazon Web Services (AWS) outage in October 2025, we are further extending our support to cyber catastrophe event scenarios.

Moody's can provide event representations for cyber catastrophe scenarios by selecting events from our stochastic cyber event catalogue to deliver event IDs that clients can run against their portfolios.

This is a significant step forward. Cyber risk has long presented unique modeling challenges: events can unfold rapidly, impacting multiple industries simultaneously, and carry significant uncertainty in both scope and loss.

Our new capability means that when a cyber catastrophe scenario is announced, whether in a live market event or as part of the DyGIST exercise, we can provide clients with a structured, model-ready event representation to support their response.

Our approach

When a cyber event or scenario is announced, our team works through a structured response process, from initial event acknowledgement and assessment of the scenario narrative, through to the identification of the most representative events from our stochastic catalogue.

We aim to issue provisional event IDs as quickly as practicable, with clear caveats; as we gather further observations or information, we may amend the selection. If appropriate, we will also consider publishing a loss estimate to support client submissions.

This approach builds on our response following the AWS outage in October 2025, where, alongside observations of the event itself, we delivered a weighted stochastic event selection for clients to run against their portfolios, combining with feedback from clients on how they use event IDs and what they need at each stage of a fast-moving event.

Ready for DyGIST

Whether the PRA announces a cloud outage, a cyberattack, or another systemic cyber scenario, Moody's has the tools and the process to respond.

As with all our DyGIST event ID deliveries, we will accompany every cyber event response with commentary on our methodology, the scope of the scenario, and its limitations, giving you the context you need to build a confident qualitative response alongside your model outputs.

For more information, please get in touch with your Moody's account representative.