TRIA's certainty ends where the hybrid cyber loss begins

With the House passing TRIA's fifth reauthorization 24-0, the terrorism backstop has moved close enough to certain that insurers can plan around it, a clean extension turning the terrorism tail from a legislative bet into a planning assumption. The part of the peril that keeps growing is the part the vote does not touch: Treasury's hybrid-attack model puts cyber at 88% of the loss, and the trigger that would decide whether the federal program shares any of it remains unfinished.

Unanimity of that order does work. A chamber does not produce a 24-0 tally on architecture it considers contested, so read the result as the House treating the conventional attack as settled—the bomb, the aircraft, the event with a location and a claims file. Insurers that have carried reauthorization as a recurring unknown on the calendar can move it into the base case, since a tail with two possible outcomes has to be modeled on the branch the industry does not expect while a tail with one outcome is an input.

Expect the certainty to register in behavior before it registers in price, because a peril with a settled federal backstop can be committed to over longer terms and appetite for the conventional attack tends to track confidence in the program behind it more than the loss experience in front of it.

What the vote does not solve is the hybrid attack, where terrorism and cyber meet in the same loss, and treating those as one peril in a risk report is where the next round of mispricing comes from.

The 88% is the tell, and it is the government's own arithmetic: on Treasury's hybrid-attack model, the loss the backstop's machinery is built around is overwhelmingly a cyber loss. Take the figure at face value and the residual—a 12% sliver—is what the program's conventional architecture was drafted to address, while everything above it sits on the industry's cyber book, where the federal trigger does not reach. Whether it reaches eventually is a drafting question, and drafting questions do not get settled by a vote in one chamber.

An unfinished trigger is not a neutral thing to hold. Where the program's cyber wording is open, a hybrid loss arrives with two plausible policies pointed at it and no agreed line between them, because the terrorism tower and the cyber tower are written against different definitions and a hybrid event is exactly where those definitions meet. That is a claims argument the day of the loss and a reserving problem for as long as it lasts.

The cyber half of a hybrid attack resists the backstop for a reason that has nothing to do with politics: aggregation. A blast has a radius; a network loss does not, and a loss moving through shared code and shared vendors does not stay inside one insured's schedule of values. Read that against the program's design—physical events, finite claims files—and the mismatch is easy to see: the architecture fits the conventional attack, but a hybrid event asks the same architecture to absorb correlation at a scale no single balance sheet holds, which is the harder question the drafting has not answered.

On that split there is an awkward inversion: the backstop catches the slice of a hybrid loss that behaves least like a catastrophe—the physical, locatable, finite part—and steps back from the slice that behaves most like one. A program the market values as catastrophe protection is, in the hybrid scenario, closer to a severity layer beneath the real tail.

The capital consequence follows: if the program addresses the physical and conventional consequences and the industry carries the network loss, the correlated half of a hybrid attack sits on private balance sheets rather than the federal one, which suggests the cyber book needs more capital behind its tail than a reading premised on federal participation would imply and that aggregate reinsurance above it clears with a wider uncertainty margin than the layer beneath.

Worth remembering that cyber is already written privately, or it would not be the gap in a reauthorization: the hybrid is less a missing coverage than a seam where two existing covers meet, and seams are cheaper to fix in a definition than in a claims file.

The practical test is definitional: ask what the trigger says about a loss that is mostly network and partly physical, and whether the answer changes how that exposure is reserved. If the answer is maybe, the recovery is contingent, and contingent recoveries are an expensive thing to hold capital against.

Then there is the calendar: the House and the Senate have not landed on the same end date, and the spread between them is the number insurers have to price this week. A reauthorization runs only as long as its final sunset, so a book priced past the earlier of the two chambers' dates carries a repricing event with no loss attached, and duration questions get resolved late, in conference, in a text nobody underwrites until it prints. The vote is the signal the market wanted; the date inside the text is the one it has to live with.

The handling of the gap is not complicated: price to the earlier date and treat everything beyond it as an option the industry receives rather than one it pays for. Pressure will run the other way, since a later date makes for a tidier model and a simpler story on a multi-year policy, but a tail that depends on a conference committee is not a tail worth financing at par.

That leaves two books that ought to be priced apart. Conventional terrorism is now a planning assumption—a peril with a federal backstop behind it, a settled legislative path, and a price that ought to be getting thinner rather than fatter—while hybrid attack sits outside that, a cyber loss wearing a terrorism label, and an insurer that treats the label as coverage is writing an unhedged position in a definition it does not control.

The reinsurance market is where the difference gets financed: a ceding company that prices the hybrid exposure as cyber finds one kind of capacity, while one that prices it as terrorism and looks to the federal program for the remainder finds another. The spread between those two structures is the market's running estimate of the unfinished trigger, and it is more likely to widen before the drafting closes than to narrow.

Treaty renewals will not wait for the conference, so any program renewing before the end date is settled is priced on an assumption about the program's duration, whether or not the underwriting file says so in as many words. That assumption deserves to be explicit.

The week's work is unglamorous: check whether the terrorism tower and the cyber tower on the same program would both respond to a single hybrid event; if they would, decide which one the underwriter intends to pay and price the other as though Washington will not. Quantify the correlation instead of assuming it away, and put the trigger language on the list the conference has to resolve next to the end date, because that is where the money is. None of it requires a new capital model, only refusing to let a definitional gap in a statute stand in for an underwriting decision in the tower.

Credit where it is due: the clean extension is the right call, handing the conventional peril a stable assumption and sparing the industry another cycle on a legislative question with an obvious answer. Right, though, is not the same as complete, and the completeness has to come from the trigger.

An unambiguous exclusion would serve the market better than a generously worded trigger nobody can underwrite, because ambiguity is not a middle position between coverage and no coverage; it clears at the price of the worse of the two, since capital has to be held against the reading the insurer cannot control. Insurers asking for clarity are not asking for less cover; they are asking for cover they can price.

Watch the conference text in order: the end date first, because it sets how long the certainty runs, then the trigger, because it decides whether the uncovered share stays on the industry's book. Neither is written, and neither was going to be settled by a tally in one chamber.