Why systemic cyber risk is still misunderstood inside a reinsurance treaty: with Tafadzwa Mugadza, CCIS

Senior Manager, Underwriting | Africa Re | Johannesburg, South Africa

Tafadzwa Mugadza is Senior Manager, Underwriting at Africa Re in Johannesburg, South Africa, and a graduate of the Certified Cyber Insurance Specialist (CCIS) V2 program. We asked where cyber risk is still misunderstood inside a reinsurance treaty, how CCIS changed day-to-day cyber underwriting, and what reinsurance underwriters should stop assuming about client demand.

Key takeaways

• In Tafadzwa’s view, systemic risk is the cyber exposure inside a reinsurance treaty that remains least understood: losses are correlated, data for quantification and modelling is thin, and the severity of a cyber event is unknown.
• CCIS strengthened Tafadzwa’s understanding of cyber risk, the evolving threat landscape and the technical terminology needed for cyber risk assessment and underwriting.
• Knowing threat vectors and attack surfaces leads to better-informed underwriting decisions and quicker turnaround times.
• Underwriters should not assume clients understand the cyber threat landscape; demand can be lower than expected where a client has not yet suffered a loss.
• For reinsurance underwriters, CCIS supports guidance on insureds’ cyber resilience, collaboration with cedants and brokers, and credible conversations with clients’ CISOs.

Inside a reinsurance treaty, which cyber insurance exposure still gets underpriced or misunderstood most often?

Cyber remains a complex risk and in my view, systemic risk is an exposure that may remain misunderstood – due to the correlated nature of the risk, lack of sufficient data for quantification which impacts modelling, and the unknown severity likely to be caused by a cyber event loss.

How has completing CCIS shaped your career path as Senior Manager of Underwriting at Africa Re?

As an underwriter, completing the CCIS course has significantly enhanced my understanding of cyber risk, the evolving threat landscape, and the technical terminology essential for effective cyber risk assessment and underwriting. It has also strengthened my underwriting expertise by adding a highly relevant and increasingly critical skill set.

In terms of professional success, what is one underwriting judgment you make differently on cyber insurance because of CCIS?

Enhanced knowledge of information technology, cyber terminology, threat vectors, and attack surfaces amongst other factors supports more effective risk assessment, leading to better-informed underwriting decisions and improved operational efficiency through quicker turnaround times.

What should other underwriters stop assuming about how clients approach cyber insurance demand today?

Underwriters should stop assuming that clients are fully aware of the extent of the cyber threat landscape and how they could be impacted. The demand may not necessarily be as high as would be anticipated particularly where clients are yet to suffer a loss.

What would you tell a reinsurance underwriter about how CCIS can change their standing with clients, cedants, and brokers?

CCIS is particularly relevant to reinsurance underwriters as it provides the fundamentals necessary to evaluate and provide guidance in strengthening the insured’s cyber resilience and preparedness.

Collaboration with cedants and brokers assists with developing appropriate coverage solutions and dissemination of pre and post claims management which is crucial for risk management. The CCIS program assists underwriters with the technical knowledge that can also help them hold meaningful conversations with the clients’ highly technical Chief Information Security Officers (CISOs).

Related Reading from Cyber Insurance Academy

• When cyber insurance starts dictating ransomware response (CIA Voices)
• How to master data-driven cyber underwriting in 2026
• Samsung Re advances cyber capability with Cyber Insurance Academy
• More CIA interviews

Frequently Asked Questions