v1.0.7April 16, 2026
Version 1.0.7
Reinsurance Tower Designer, Portfolio Optimizer, Continuous Risk Monitor, Regulatory & War Exclusion Center, Emerging Risk LabReinsurance Tower Designer (new page)
- Drag-and-drop multi-layer tower builder: Quota Share, Working Layer XoL, Catastrophe XoL, and Aggregate Stop-Loss
- Inuring waterfall engine — move layers up/down to test alternative inuring orders; each layer sees the net loss after all preceding layers
- Per-layer parameters: cession %, ceding commission, attachment, limit, rate-on-line, reinstatements
- Monte Carlo engine runs 1,500 to 10,000 simulated years against the selected portfolio source, returns gross + net EP curves, VaR99 / VaR99.5, and per-layer expected cession
- Per-layer economics table: premium, expected cession, loss ratio, RoL, margin
- Gross vs Net recovery table at 10 return periods (1-in-0.5 through 1-in-250)
- Cession optimizer sweep — automatically iterates QS % from 0% to 70% and surfaces the capital-efficient cession point with $ saved per $ ceded ratio
- Save / reload full tower configurations (Mongo-persisted)
- Portfolio source picker: run tower against your in-force CRM portfolio OR any saved bordereau
Portfolio Optimizer (new page)
- Severity-aware Monte Carlo engine pulls real incident history from the feed (count, max severity, severe count, ransomware history, leak-site hits)
- Per-insured Euler/Shapley decomposition of portfolio AAL and TVaR — additive allocation, Solvency II standard
- Concentration index (TVaR share ÷ fair share × N): > 1.2 = CONCENTRATOR, < 0.8 = DIVERSIFIER, else NEUTRAL
- Recent-catastrophic OVERRIDE: any insured with max severity ≥ 75, ≥ 2 severe incidents in 180d, ransomware history, or leak-site hit is hard-flagged RECENT INCIDENTS and cannot be marked DIVERSIFIER regardless of the math
- RAROC heatmap per insured: (premium − expected loss − expense) ÷ (TVaR × capital charge); green if above target, red if capital-destructive
- Renewal Walk-Away engine — classifies every policy as RENEW / RE-RATE +X% / NON-RENEW with the exact rate change required to clear the hurdle
- User-tunable assumptions (expense ratio, capital charge, target RAROC, target LR) persisted in localStorage
- Per-insured incident columns (180d count, max severity) with 🔒 ransomware and 🚨 leak-site icons
Continuous Risk Monitor (new page) — powered by the real incident feed
- Reads cyber_portfolio.blog_data (the same source as the Incidents page) in real time — no synthetic signals
- Per-insured incident counts in 30 / 60 / 90 / 180 day windows with velocity Δ30d (heating vs cooling)
- Severity sum 90d and max severity 90d derived from per-incident severity score
- Threat actors observed from incident_details.threat_actor (handles both string and dict/list shapes)
- Ransomware families observed from incident_details.ransomware.ransomware_strain (with fallback extraction)
- MITRE ATT&CK techniques from incident_details.mitre_correlation with technique IDs and names
- Leak-site radar: flags insureds appearing on ransomware leak sites (LockBit, Cl0p, Akira, ALPHV, RansomHub) before FNOL
- Portfolio Loss-Ratio Leading Indicator: green / amber / red composite of velocity, severity intensity, leak hits, and distressed share — 60-90 day look-ahead
- Per-insured drawer with full signal detail: latest incident with source URL, all actors, all ransomware families, all MITRE techniques, leak-site details
- Portfolio Threat Intelligence panel: top threat actors, top ransomware families, top MITRE techniques, top incident types — ranked across the whole book
- Severity classification: alert (leak hit OR ≥2 incidents in 30d OR max sev ≥ 75 OR velocity ≥ 2) → watch → ok
Regulatory & War Exclusion Center (new page) — now geography-aware
- Regulatory heatmap: maps every insured to 9 applicable regimes based on BOTH industry AND jurisdiction (country code parsed from headquarters address)
- DORA and NIS2 only apply to EU entities; SEC Item 1.05 only to US-listed; NY DFS Part 500 only to US financials; HIPAA only to US healthcare; GDPR to EU + UK; CCPA to US; PCI-DSS global; UK FCA to GB — no more false positives on jurisdictional scoping
- Unknown-country warning banner when insureds lack headquarters data
- Portfolio geography distribution card (country code chips with counts)
- Expected regulatory fine tail per insured (max fine × score factor × 40% probability weight)
- War Exclusion Engine — replays 5 named state-attributed scenarios (NotPetya, SolarWinds, Viasat, hypothetical grid attack, CrowdStrike-class state sabotage) against the portfolio under LMA 5567A/B wording
- Geographic loss multipliers: primary impact countries take 100% of scenario loss (NotPetya → Ukraine), secondary take spillover (EU/US/GB 55%), outside take minimal (5%) — a US-only company isn't hit the same as a UA-based company by NotPetya
- Per-insured geo tier badges: PRIMARY / SECONDARY / OUTSIDE with multiplier %
- Exclusion efficacy %, gross loss, excluded loss, paid loss by scenario
- OFAC Sanctions Audit Ledger — client-side immutable audit trail (timestamp, checker, result) for strict-liability defense
Emerging Risk Lab (new page)
- Four-dimension classification for the 2025-2026 frontier risks that traditional cyber wordings handle poorly
- AI-BOM Risk: per-insured AI/GenAI exposure score (model risk, prompt injection, training data poisoning, agentic AI, hallucination liability) with Low / Medium / High tier
- Quantum HNDL (Harvest Now, Decrypt Later): Critical / Material / Low tier for sectors with long-life sensitive data (banking, health, defense, legal, pharma)
- Deepfake / synthetic identity: High / Medium / Low for banking / financial / insurance / legal / executive operations (Arup $25M precedent)
- Critical infrastructure dependency: Critical / Material / Low for energy, telecom, transport, water, health, government (CrowdStrike / Fastly / MOVEit / Change Healthcare pattern)
- Aggregate Emerging Risk Index (ERI) 0-100 — average of the four dimensions, color-coded
- 5 tabs: Overview with all 4 tiers / dedicated per-dimension views
- Portfolio summary KPIs: AI High count, Quantum Critical count, Deepfake High count, Infra Critical count
Saved Loss Exceedance Scenarios — persistent across pages
- New Save / Load dropdown on the Loss Exceedance page — persist a full scenario (coverage limit, retention, severity model, correlation factor, confidence levels, industry filter, reinsurance layer, supply chain contagion, cat bond selection) as a named snapshot
- Mongo-persisted per-user in CRM.loss_exceedance_scenarios — survives across devices and sessions
- Full CRUD endpoints: GET/POST/PUT/DELETE /api/company/crm/analytics/scenarios with two-step inline delete confirmation (no more window.confirm hangs in Electron)
- Cat bond selection round-trips correctly: _selected_bond_id is persisted so reloading a scenario restores the exact bond from the dropdown, not just the underlying catbond_* parameters
- Scenario picker on the What-If Simulator — apply any saved scenario's parameters as the baseline pricing assumptions for marginal analysis
- Re-run button appears next to the loaded scenario — one click to re-simulate after any tweak
- Fetch timeout (AbortController 15s) on all scenario operations prevents frozen save modals when the backend stalls
- Active scenario chip is highlighted in blue on the LE page — clear which assumptions are currently loaded
Bordereaux Workbench — major upgrade
- RFC-4180-ish CSV parser with auto-detected delimiter (, ; | tab), quoted fields, escaped quotes, BOM, CRLF
- Drag-and-drop file upload + paste + Download example bordereau button (20 realistic policies with cedent-format columns)
- Smart auto-mapping with ~50 column header aliases (Insured Name / Named Insured / DBA / GWP / SIR / Aggregate Limit …)
- Cedent column-mapping templates: save once per cedent in localStorage, auto-apply on next quarter's upload — zero re-mapping
- Validation engine: per-row warnings (missing fields, retention ≥ limit, premium > 50% of limit) with green/amber/red banner
- Enrichment pipeline per row: insured resolution with match confidence, score + band, incident count, model premium, premium adequacy, rate-on-line
- BIND / REVIEW / DECLINE decision engine with reason codes (e.g. 'Score 540 below floor · 3 historical incidents · Premium 65% of model')
- Portfolio Impact panel: runs dual parallel Monte Carlo (in-force baseline vs in-force + bordereau) and shows AAL / VaR99 / diversification deltas
- Save Bordereau (Mongo-persisted) — every saved bordereau becomes a selectable 'named portfolio' on Loss Exceedance, What-If, Reinsurance Tower, Portfolio Optimizer, and every analytics page
- Annotated CSV export with all enrichment columns + decision + reason + warnings
- Per-row drill-down: click any insured name → opens Premium Estimation prefilled with that linkedin_id
Backend — shared analytics engine
- New severity-aware Monte Carlo engine (_simulate_gross_years) used by Reinsurance Tower, Portfolio Optimizer, and Loss Exceedance
- New _fetch_incident_severity_stats helper returns per-insured count, max_severity, severe_count, severity_sum_90d, ransomware_history, leak_site_hit from cyber_portfolio.blog_data
- Frequency calibration now factors in count × max_severity × severe_count; severity (lognormal mean) amplified ×2.5 for insureds with max_severity ≥ 80
- _enrich_companies now parses country_code from the headquarters field (supports ISO-2 + common full-name mappings) and exposes is_eu / is_us / is_uk flags
- New /reinsurance-towers CRUD collection for saving towers per user
- bordereau_id and external_ids_merge query params added to /loss-exceedance so any bordereau becomes a usable portfolio source across every analytics endpoint
- Defensive field extraction (_safe_str / _safe_str_list / _extract_named_field) — fixes the 'list object has no attribute strip' crash and correctly extracts ransomware_strain from dict-shaped ransomware fields
Cross-page integration
- Every analytics page now accepts a saved bordereau as its portfolio source via a dropdown — run Loss Exceedance, What-If, Reinsurance Tower, Portfolio Optimizer, Continuous Risk Monitor, Regulatory Center, or Emerging Risk Lab against any saved cedent book without touching your in-force portfolio
- Per-insured name clicks drill into Premium Estimation prefilled with the linkedin_id across every table
- Saved Loss Exceedance scenarios (coverage limit, severity model, contagion settings, cat bond config) can be applied on the What-If page so marginal analysis uses the same pricing assumptions