Why Critical-Infrastructure Cyber Underwriting Needs OT Data, Not IT Questionnaires

Critical-infrastructure cyber underwriting has a data problem. The application forms and risk assessments that insurers use for commercial cyber risks were designed for enterprise IT environments, where the worst-case loss is data theft or business interruption. But when the insured runs a power plant, a water treatment facility, or a pipeline control room, the worst-case loss is physical destruction, environmental damage, and cascading service outages that affect millions of people. Reinsurers are now demanding operational-technology data that shows what sits on the plant floor, and IT questionnaires cannot provide it.

Why has operational-technology data become the dividing line in critical-infrastructure cyber reinsurance?

Operational-technology data has become the dividing line because reinsurers have learned that two power utilities with identical IT security scores can have radically different cyber risk profiles depending on what industrial control systems they run, how those systems are networked, and whether anyone has inventoried them. The IT score describes the office network. The OT data describes the plant, and the plant is where the loss lives.

The gap between IT and OT underwriting is widening at exactly the moment when critical-infrastructure cyber premiums are growing fastest. Governments are mandating cybersecurity standards for power and utilities operators. Regulatory frameworks like NERC CIP in North America and the NIS2 Directive in Europe are pushing operators to inventory and segment their industrial networks. Insurers who continue to underwrite these risks with IT-only questionnaires are pricing a risk they cannot see, and reinsurers who accept those submissions are accumulating exposure they cannot measure.

The result is a bifurcation in the market. Cedents who can deliver OT asset inventories, network segmentation maps, and vendor-concentration analysis earn reinsurance capacity and terms that reflect measured risk. Cedents who cannot are finding capacity constrained, sublimited, or priced with heavy uncertainty loads. The evolution of cyber as a systemic peril has made OT data the treaty-readiness standard for critical-infrastructure cyber.

What goes wrong when critical-infrastructure cyber is underwritten without OT data?

Underwriting critical-infrastructure cyber without OT data fails in five ways: IT controls are mistaken for OT security posture, legacy industrial systems are invisible to assessment, network segmentation is assumed but not verified, vendor concentration is unmeasured, and cyber-physical clash exposure is never quantified. Each failure below compounds the reinsurance accumulation risk.

The following five gaps are present in most cyber portfolios with critical-infrastructure exposure today. Each one represents a modeling blind spot that reinsurers are beginning to close.

1. Why do IT security scores misrepresent OT risk?

IT security scores misrepresent OT risk because they measure the maturity of the enterprise network, firewalls, endpoint protection, patching cadence, identity management, none of which describe the industrial control systems that actually run the plant. A utility can score in the top decile on IT security and still have unpatchable Windows XP engineering workstations directly connected to turbine controllers.

The score mismatch is dangerous because it gives underwriters and reinsurers a false sense of portfolio quality. A book of critical-infrastructure risks that all carry strong IT security scores looks well-managed on a summary report. But the OT environments beneath those scores may be flat, unsegmented, and running controllers with known vulnerabilities that have never been patched because patching requires a plant shutdown. The data quality gap between IT and OT is the single largest source of hidden accumulation in cyber reinsurance today.

2. How do legacy industrial systems stay invisible to underwriting?

Legacy industrial systems stay invisible because they do not appear on IT asset registers, do not run discoverable operating systems, and are managed by engineering teams who operate outside the IT organization. The underwriting questionnaire goes to the CISO, who may not even know what PLC models are installed on the plant floor.

This is the organizational silo problem. In most critical-infrastructure operators, the chief information security officer owns cybersecurity for the business network, and the VP of operations owns the industrial control systems. The CISO fills out the insurance application based on the IT environment they control. The OT environment, where the catastrophic loss scenarios live, is not represented in the submission because nobody asked the operations team for their asset inventory. A facultative risk assessment that reaches the OT team would surface this gap, but standard underwriting workflows rarely do.

3. What happens when OT-IT network segmentation is assumed?

When OT-IT network segmentation is assumed, the reinsurer models a contained OT environment that an attacker cannot easily reach from the business network. In reality, many operators have converged their OT and IT networks for operational efficiency, and the segmentation exists on architecture diagrams but not on the wire.

Convergence is the industry trend. Operators want real-time production data in their ERP systems, remote access for vendor support, and predictive-maintenance analytics that require OT data in the cloud. Each of those connections is a path from the internet to the industrial controller. Without verified segmentation data, reinforced by network architecture validation, the reinsurer must assume the worst-case: every OT device is reachable from the internet through the IT network.

4. Why does OT vendor concentration create systemic exposure?

OT vendor concentration creates systemic exposure because a small number of manufacturers, Siemens, Schneider Electric, Rockwell Automation, Honeywell, supply the industrial controllers and software that run most critical infrastructure globally. A vulnerability in one vendor's product line can simultaneously affect dozens of insured operators.

This is the systemic-peril mechanism in its OT-specific form. When a researcher discovers a remote-code-execution vulnerability in a widely deployed PLC family, every utility and industrial operator using that PLC model becomes simultaneously exploitable. The accumulation can cross cedent portfolios, treaty years, and geographic boundaries. A multi-treaty exposure tracker that maps OT vendor concentration is the tool that reveals this exposure, but few reinsurers have one.

5. How does cyber-physical clash go unmodeled?

Cyber-physical clash goes unmodeled because cyber and property reinsurance treaties are placed and managed by different teams who rarely compare their exposure maps. A cyber attack that destroys a turbine triggers the cyber treaty for the attack and the property treaty for the physical damage, a dual-trigger event that neither treaty's pricing assumed.

This is the aggregation-clash problem in its most acute form. The cedent's cyber team may not know what the property team has written on the same power-generation portfolio. The reinsurer who writes both treaties may discover the clash only when claims arrive from both sides simultaneously. An aggregation agent that maps cyber-exposed physical assets against property treaty exposures would surface the clash before it becomes a loss, but the capability is not yet standard.

Replace IT-only underwriting with OT asset intelligence reinsurers can trust

Talk to Our Specialists

Visit Insurnest to learn how we help reinsurers and cedents bring operational-technology data into critical-infrastructure cyber underwriting and treaty placement.

What do OT security underwriters actually expect from asset data at placement?

OT security underwriters expect a complete asset inventory of industrial control systems for each material risk, network segmentation verification with traffic-flow evidence, safety-consequence classification for critical assets, vendor and firmware concentration analysis, and a cyber-physical clash map that identifies which property covers a successful OT attack could trigger.

Marcus underwrites critical-infrastructure cyber for a specialty insurer that cedes a large share of its book to reinsurers. He spent the first five years of his career writing cyber for law firms, retailers, and tech companies, using the same IT-security questionnaire every commercial cyber underwriter uses. When he moved to the critical-infrastructure desk, he discovered that his questionnaire asked about encryption standards and patch management but had no field for "what happens if someone sends a malicious command to the turbine controller?"

He built his own OT data requirements. For every risk he binds, he now requires an asset inventory of industrial control systems, a network diagram showing OT-IT segmentation with the date of the last segmentation test, and a safety-consequence rating for each critical asset. The first few submissions he received were incomplete, some operators had never built an OT asset inventory, but over two years the market has moved. The operators who want coverage have built the inventories, and the ones who will not are finding capacity scarce.

Here is what Marcus and his reinsurance partners now consider non-negotiable.

"Show me every industrial controller, its make, model, firmware version, and network segment." An asset that is not inventoried is an asset the operator cannot secure, and the underwriter cannot price.
"Prove that your OT network is segmented from your IT network with a recent penetration test or traffic-flow analysis." A network diagram is not proof. Reinsurers want test evidence that the segmentation holds.
"Classify each critical asset by the safety or service consequence of its compromise." A controller that can cause a pressure explosion is a different risk from a controller that reads ambient temperature.
"List the remote-access paths into your OT environment, including vendor support connections." Every remote-access path is an attack surface. Unknown remote access is unmodeled exposure.
"Identify which OT vendors are common across your entire operator portfolio." A vulnerability in a widely deployed vendor product creates portfolio-level accumulation that individual policy underwriting will not detect.
"Map which property policies, engineering policies, or liability policies sit on the same operator." A cyber attack that causes physical damage is a clash event. The cyber underwriter needs to know what other covers are exposed.
"Show me your OT change-management process and the date of the last firmware update on critical controllers." Unpatchable legacy controllers are the norm in OT, but the cedent needs to know how many there are and what compensating controls exist.
"Quantify the maximum physical-damage loss a successful OT cyber attack could produce at each facility." This is the scenario that should anchor the limit deployment and treaty structure for critical-infrastructure cyber.
"Provide your incident-response plan for OT-specific scenarios, including safety-system override procedures." An IT incident-response plan describes data recovery. An OT plan describes how to shut down a turbine safely while under attack.
"Update the OT asset inventory at every renewal and after every major control-system change." OT environments change, new controllers are installed, old ones decommissioned. A stale inventory is a misrepresentation waiting to happen.

Marcus's data requirements have made him a harder underwriter to satisfy but a better partner for reinsurers. His submissions now include an OT data appendix that answers most reinsurer questions before they are asked. The capacity and terms his book commands reflect that preparation.

How can cedents build OT data pipelines for treaty-ready submissions?

Cedents build OT data pipelines by capturing OT asset inventories at underwriting, verifying network segmentation with evidence, mapping vendor and firmware concentration, classifying safety consequences, modeling cyber-physical clash, and refreshing OT data at every renewal cycle.

Each of the underwriter expectations above maps to a capability a cedent can build. Here is what that looks like in practice.

1. How does OT asset-inventory capture at underwriting work?

OT asset-inventory capture at underwriting works by making the inventory a required submission document, not an optional supplement. The cedent provides a structured template that asks for every controller by make, model, firmware, and network segment, and the underwriter reviews it alongside the IT security questionnaire.

This is the data-quality foundation. The template standardizes what operators submit, making it possible to compare OT risk profiles across policyholders and aggregate inventory data at the portfolio level. An operator who cannot produce an inventory is treated as maximum risk regardless of what the IT questionnaire says.

2. What does network-segmentation verification deliver?

Network-segmentation verification delivers proof that the OT environment is not reachable from the internet through the business network. It requires a recent penetration test, network traffic analysis, or passive monitoring data that confirms the segmentation controls operate as designed.

This is the capability that distinguishes documented segmentation from real segmentation. A treaty analysis tool that ingests segmentation test results gives the cedent an auditable record it can present at renewal, and gives the reinsurer confidence that the OT exposure is contained rather than open.

3. How does vendor and firmware concentration mapping work?

Vendor and firmware concentration mapping works by aggregating the OT asset inventories across the portfolio and identifying which vendors, product lines, and firmware versions appear most frequently among the highest-limit policyholders, flagging the concentration points where a single vulnerability could trigger multiple claims.

This is the risk aggregation discipline applied to OT vendor data. Once the cedent knows that 60% of its aggregate critical-infrastructure limit uses Siemens S7-1500 controllers running a specific firmware family, a vulnerability advisory for that product line becomes a portfolio event that triggers immediate exposure assessment.

4. Why classify safety consequences of asset compromise?

Classifying safety consequences matters because it separates controllers whose compromise would cause nuisance alarms from controllers whose compromise would cause explosions, chemical releases, or loss of life. The classification determines which assets drive the risk profile and which can be accepted with standard controls.

An operator with a thousand PLCs where only twelve have high-safety-consequence ratings is a different risk from an operator where two hundred carry that rating, even if the total controller counts are similar. A facultative risk assessment that incorporates safety classification gives the reinsurer the one metric that matters most for critical-infrastructure cyber: how many of the insured's assets can cause catastrophic physical harm if compromised.

5. How is cyber-physical clash modeled for treaty purposes?

Cyber-physical clash is modeled by overlaying the cedent's critical-infrastructure cyber exposures onto its property, engineering, and liability treaty exposures for the same policyholders, identifying where a single cyber attack could trigger claims across multiple lines and treaties simultaneously.

This requires coordination between the cyber ceded team and the property ceded team, which rarely happens today. A multi-treaty exposure tracker that brings both views into one screen enables the cedent to present the clash picture to reinsurers proactively, and to structure treaty wording that clarifies which cover responds first.

6. What does OT data refresh at renewal involve?

OT data refresh at renewal involves re-collecting the OT asset inventory, re-verifying network segmentation, updating firmware versions, and identifying any new controllers, decommissioned assets, or architecture changes since the last submission, so the reinsurer sees the current plant, not the plant as it was twelve months ago.

OT environments change more slowly than IT environments, but they do change. A turbine overhaul that replaces controllers, a new remote-access path added for a vendor, a segmentation change driven by a SCADA upgrade, any of these can alter the risk profile materially. A renewal-season data discipline that treats OT data refresh as mandatory, not optional, keeps the submission credible and the treaty terms aligned with the actual exposure.

Build OT data pipelines that earn capacity and trust in critical-infrastructure cyber

Talk to Our Specialists

Visit Insurnest to learn how we help cedents, brokers, and reinsurers capture operational-technology asset data for cyber treaty submissions.

What does a treaty-ready critical-infrastructure cyber submission look like?

A treaty-ready critical-infrastructure cyber submission includes an OT asset inventory for each material risk, verified network segmentation, vendor and firmware concentration analysis, safety-consequence classification, a cyber-physical clash map, and a refresh cadence that keeps the OT data current.

Marcus delivers his submission to the lead reinsurer three weeks before renewal. The OT data appendix runs thirty pages: an asset-inventory summary showing the top controller makes and firmware families across the portfolio, a segmentation-verification status for every policyholder with a critical-infrastructure exposure, a vendor-concentration chart showing that 47% of aggregate limit uses one manufacturer's controllers, and a clash map that identifies eleven policyholders where the same reinsurer writes both the cyber treaty and the property treaty. The safety-consequence analysis shows that of 3,200 inventoried OT assets, 84 carry high-safety-consequence ratings and those 84 account for 71% of the modeled worst-case loss.

In the meeting, when the reinsurer's OT specialist asks about the firmware concentration, Marcus shows the firmware-age distribution: 22% of controllers are running firmware more than five years old with known vulnerabilities, and those controllers are concentrated in six policyholders that collectively represent 31% of the aggregate limit. The discussion is about whether those six should be sublimited or whether the cedent's remediation plan for the next twelve months justifies full capacity. It is a negotiation anchored in data, not in language, and both sides leave with a shared understanding of the exposure.

That is the treaty-readiness standard the critical-infrastructure cyber market is moving toward. Cedents who can present an OT data submission at this level are commanding terms that competitors still relying on IT-only questionnaires cannot touch, particularly as AI-driven risk assessment makes OT exposure patterns more visible to the reinsurance side.

Bring OT asset intelligence to your next cyber treaty renewal

Talk to Our Specialists

Visit Insurnest to learn how we help insurers and reinsurers operationalize OT asset data for critical-infrastructure cyber underwriting and treaty placement.

Conclusion

For critical-infrastructure cyber reinsurance, the IT questionnaire era is ending. Reinsurers who accept cyber submissions on power plants, water systems, and industrial facilities without operational-technology data are accumulating exposure they cannot measure, and the market is increasingly unwilling to price what it cannot see.

For ceding teams, the mandate is practical. Capture OT asset inventories at underwriting, verify segmentation with evidence, map vendor and firmware concentration, classify assets by safety consequence, model the cyber-physical clash, and refresh OT data at every renewal. These are not aspirational capabilities; they are the data foundation that critical-infrastructure cyber reinsurance now requires.

The cedents who build OT data pipelines today will be the ones whose submissions command capacity, whose treaty terms reflect measured risk rather than uncertainty loads, and whose reinsurer relationships are built on demonstrated asset command. In a hardening market for critical-infrastructure cyber, OT data is the difference between capacity that is offered and capacity that is earned.

Frequently asked questions

What is operational technology data in the context of cyber reinsurance?

Operational technology data describes industrial control systems, SCADA networks, PLCs, and sensors that run physical infrastructure. For reinsurers, it turns vague cyber exposure into quantified, asset-level risk that can be underwritten and priced clearly.

Why do IT security questionnaires fail for critical infrastructure underwriting?

IT questionnaires capture enterprise-network controls like endpoint detection and patch management. Critical-infrastructure risk lives in OT networks with different protocols, patch cycles, and failure consequences where downtime means physical safety incidents, not lost data.

What does an OT asset inventory include?

An OT asset inventory includes every industrial controller, sensor, actuator, engineering workstation, and network gateway in the operational environment, catalogued by make, model, firmware version, network segment, and safety consequence of compromise.

How does OT data change reinsurance treaty pricing?

OT data lets reinsurers distinguish a utility with segmented, inventoried industrial networks from one running flat OT-IT architecture with unpatchable legacy controllers. The pricing difference between those two profiles can span an order of magnitude.

Which critical-infrastructure sectors carry the highest cyber accumulation risk?

Electric power, water treatment, and oil and gas pipelines carry the highest accumulation risk because they share common control-system vendors. One OT vulnerability can simultaneously threaten dozens of operators across multiple cedent portfolios.

Can a cyber attack on OT systems trigger physical damage reinsurance covers?

Yes, a cyber attack causing equipment destruction, explosion, or environmental release can trigger both cyber and property treaties simultaneously. This creates clash exposure that most reinsurers have not fully mapped across their multi-line portfolios.

What makes OT environments harder to secure than IT environments?

OT environments run legacy systems designed for decades with no native security, cannot be patched without production downtime, and use proprietary protocols invisible to standard tools. A turbine controller cannot run endpoint detection software.

What should a treaty-ready critical-infrastructure cyber submission include?

It should include an OT asset inventory for each material policyholder, network segmentation verification, safety-consequence classification for critical assets, vendor concentration analysis, and a clear view of which physical perils a cyber event could trigger.

About the author

Hitul Mistry is the Founder of Insurnest, an InsurTech company that engineers end-to-end technology exclusively for the insurance industry serving carriers, TPAs, MGAs, brokers, and reinsurers across India, the UAE, and the US. With more than a decade of insurance domain experience, he has built systems spanning underwriting automation, AI-powered underwriting intelligence, claims management, rating and quoting, broking and agency platforms, and reinsurance automation across Health/GMC, Group Life, Motor, P&C, and Reinsurance. Insurnest doesn't adapt generic software to insurance; it builds from the workflow up.

Connect with Hitul on LinkedIn.

Posts tagged with#critical infrastructure cyber

Critical-Infrastructure Cyber: Bringing Operational-Technology Data Into Reinsurance