サイバー保険市場 2026 ディープダイブ:Chubb、AIG CyberEdge、Beazley、Coalition、Resilience、AXA XL、Hiscox、Tokio Marine HCC + 韓国・日本サイバー保険完全比較

# lmm-5564-cyber-war-exclusion.yaml — Lloyd's Market Association 標準約款サマリ
exclusion_name: 'Cyber Operation in the Course of War or Cyber Operation'
clause_id: 'LMA5564'
effective_date: '2023-03-31'
applies_to:
  - standalone_cyber_policy
  - cyber_endorsement_to_property
core_definitions:
  cyber_operation: |
    The use of a Computer System by, at the direction of, or under the control
    of a State to disrupt, deny, degrade, manipulate or destroy information
    in a Computer System of or in another State.
  war: |
    Use of physical force by a State against another State, whether or not
    war has been declared.
trigger_attribution:
  - government_attribution_in_affected_state_takes_precedence
  - reasonable_inference_from_objective_evidence
  - lloyds_specific_attribution_service_acceptable
carve_backs:
  - bystander_cyber_operations_below_material_threshold
  - non_state_actor_attacks_not_directed_by_state
material_impact_test:
  - significant_state_function_impairment
  - critical_national_infrastructure_compromise

# Chubb Cyber ERM 2026 標準保障構造(米国基準)
Coverage Module                    Default Limit       Sub-limit Caveats
---------------------------------  ------------------  ----------------------------
1st-party Data Recovery            Full Policy Limit   Hardware bricking excluded
Business Interruption (income)     Full Policy Limit   72hr waiting period
Contingent BI (vendor outage)      $5M sublimit        Named vendors only
Cyber Extortion / Ransomware       80% of Policy       OFAC compliance required
Reputational Harm Loss             $2M sublimit        12mo measurement window
Bricking (hardware replacement)    $1M sublimit        Diagnostic report required
Funds Transfer Fraud (BEC)         $250K sublimit      Voice verification waiver
3rd-party Privacy Liability        Full Policy Limit   GDPR fines via insurable jx
3rd-party Network Security         Full Policy Limit   War exclusion LMA5564
Regulatory Defense & Penalties     $1M sublimit        Where insurable by law
PCI-DSS Assessments / Fines        Full Policy Limit   Compromise must trigger
Media Liability                    $1M sublimit        Owned media only

# beazley_bbr_response_workflow.py — BBR 事故対応フロー擬似コード
from datetime import datetime, timedelta

class BBRIncidentResponse:
    """Beazley Breach Response 標準対応プレイブック (2026 v7)。"""

    SLA_FIRST_CONTACT_HOURS = 1
    SLA_IR_VENDOR_ONSITE_HOURS = 4
    SLA_COUNSEL_ENGAGEMENT_HOURS = 2

    def __init__(self, policy):
        self.policy = policy
        self.timeline = []
        self.vendor_panel = {
            'forensics': ['Mandiant', 'CrowdStrike', 'Kroll'],
            'counsel': ['Mullen Coughlin', 'BakerHostetler', 'Lewis Brisbois'],
            'pr': ['Edelman', 'Sard Verbinnen'],
            'ransomware_negotiator': ['Coveware', 'GroupSense'],
        }

    def notify(self, incident_type, detected_at):
        self.timeline.append(('insured_notice', datetime.utcnow()))
        # SLA: 1時間以内に Beazley breach manager を割当
        bm = self.assign_breach_manager(incident_type)
        # SLA: 2時間以内に外部法務カウンセル engaged
        counsel = self.engage_counsel(incident_type)
        # SLA: 4時間以内に forensic vendor onsite
        forensics = self.dispatch_forensics(incident_type)
        return {
            'breach_manager': bm,
            'counsel': counsel,
            'forensics': forensics,
            'sla_clock_started_at': detected_at,
            'first_response_deadline': detected_at + timedelta(hours=1),
        }

    def assign_breach_manager(self, incident_type):
        # 事故種別ごとの専任BM割当 — ransomware/BEC/data exfil/insider
        return f'BM_{incident_type}_{hash(incident_type) % 50}'

# coalition_rating_engine.py — Active Insurance 価格決定擬似コード
# 2026年 Coalition Risk Platform を再構成

def coalition_premium_quote(applicant):
    """
    Coalition のアクティブレーティングは静的アンケートではなく
    リアルタイム外部スキャン結果を直接価格に反映する。
    """
    base_rate = applicant.revenue * 0.0008  # 0.08% of revenue
    multiplier = 1.0

    scan = run_external_scan(applicant.domains, applicant.ip_ranges)

    # 1. Email security (DMARC + SPF + DKIM)
    if not scan.dmarc_quarantine_or_reject:
        multiplier *= 1.35
    if scan.spf_softfail_only:
        multiplier *= 1.10

    # 2. MFA — Coalition は RDP/VPN/admin MFA を別検証
    if scan.exposed_rdp_without_mfa:
        multiplier *= 1.75  # ほぼ謝絶水準
    if not scan.mfa_on_o365_admin:
        multiplier *= 1.40

    # 3. EDR — CrowdStrike/SentinelOne/MS Defender for Endpoint
    if applicant.attested_edr in {'crowdstrike', 'sentinelone', 'mde-p2'}:
        multiplier *= 0.85

    # 4. Backup — オフサイト + immutable
    if applicant.backup_immutable and applicant.backup_offsite:
        multiplier *= 0.90

    # 5. CVE exposure — KEV カタログ照合
    kev_hits = scan.cve_matches_against_cisa_kev()
    multiplier *= (1.0 + min(kev_hits * 0.05, 0.50))

    # 6. Industry — healthcare/finance は基礎係数が高い
    industry_loads = {'healthcare': 1.20, 'finance': 1.15, 'manufacturing': 1.05}
    multiplier *= industry_loads.get(applicant.industry, 1.0)

    return round(base_rate * multiplier, 2)

# samsung-fire-cyber-solution-plus-2026.yaml — 約款サマリ
保険会社: サムスン火災海上保険
商品名: Cyber Solution Plus
限度額_KRW:
  総保障最大: 5_000_000_000
  個人情報漏えい賠償: full_policy_limit
  IR_事故対応費用: 500_000_000
  事業中断損害: 2_000_000_000
  ランサムウェア交渉費用: 200_000_000
  身代金支払い: 不担保   # 外国為替法・特金法と抵触
  PR_評判毀損: 100_000_000
主要免責:
  - 国家支援サイバー攻撃: LMA5564準用
  - PIPA故意違反罰金
  - 無許可暗号資産取引
  - OFAC・UN制裁対象支払い
加入要件:
  - ISMSまたはISMS_P認証
  - 定期脆弱性診断_年2回
  - バックアップ_3_2_1運用
含まれるサービス:
  - KISA事故申告支援
  - 侵害事故対応チームパネル: ['Igloo Corporation', 'SK Shieldus', 'AhnLab']

# nist-csf-2-self-assessment-template.yaml
# NIST CSF 2.0 (Feb 2024) — Govern 関数を追加
# 保険加入前セルフアセスメントテンプレート
organization: ACME Corp
assessment_date: 2026-05-25
csf_version: '2.0'

govern:
  GV.OC: 'Tier 3'   # Organizational Context
  GV.RM: 'Tier 3'   # Risk Management Strategy
  GV.RR: 'Tier 2'   # Roles, Responsibilities, Authorities
  GV.PO: 'Tier 3'   # Policy
  GV.OV: 'Tier 2'   # Oversight
  GV.SC: 'Tier 2'   # Supply Chain Risk Management
identify:
  ID.AM: 'Tier 3'   # Asset Management
  ID.RA: 'Tier 2'   # Risk Assessment
  ID.IM: 'Tier 2'   # Improvement
protect:
  PR.AA: 'Tier 4'   # Identity Management, Authentication
  PR.AT: 'Tier 3'   # Awareness and Training
  PR.DS: 'Tier 3'   # Data Security
  PR.PS: 'Tier 3'   # Platform Security
  PR.IR: 'Tier 3'   # Technology Infrastructure Resilience
detect:
  DE.CM: 'Tier 3'   # Continuous Monitoring
  DE.AE: 'Tier 3'   # Adverse Event Analysis
respond:
  RS.MA: 'Tier 3'   # Incident Management
  RS.AN: 'Tier 3'   # Incident Analysis
  RS.CO: 'Tier 3'   # Incident Response Reporting and Communication
  RS.MI: 'Tier 2'   # Incident Mitigation
recover:
  RC.RP: 'Tier 3'   # Incident Recovery Plan Execution
  RC.CO: 'Tier 2'   # Incident Recovery Communication
overall_target_profile: 'Tier 3 across all functions by 2027-Q1'

# mitre_attack_risk_scoring.py — 保険会社サイド評価擬似コード

ATTACK_TECHNIQUES = {
    'T1566': {'name': 'Phishing', 'tactic': 'Initial Access', 'freq': 0.95},
    'T1078': {'name': 'Valid Accounts', 'tactic': 'Initial Access', 'freq': 0.78},
    'T1190': {'name': 'Exploit Public-Facing App', 'tactic': 'Initial Access', 'freq': 0.62},
    'T1486': {'name': 'Data Encrypted for Impact', 'tactic': 'Impact', 'freq': 0.71},
    'T1567': {'name': 'Exfiltration to Cloud Storage', 'tactic': 'Exfiltration', 'freq': 0.55},
    'T1110': {'name': 'Brute Force', 'tactic': 'Credential Access', 'freq': 0.48},
}

DEFENSIVE_CONTROLS = {
    'T1566': ['email_dmarc', 'awareness_training', 'sandbox', 'safe_links'],
    'T1078': ['mfa_admin', 'mfa_remote', 'privileged_session_recording'],
    'T1190': ['waf', 'rasp', 'public_asset_scan', 'patch_sla_critical_7d'],
    'T1486': ['immutable_backup', 'edr_ransomware_canary', 'segmentation'],
    'T1567': ['dlp_egress', 'cloud_proxy', 'data_classification'],
    'T1110': ['account_lockout', 'mfa_remote', 'password_spraying_detection'],
}

def compute_attack_risk_score(applicant_controls):
    score = 0.0
    for tid, meta in ATTACK_TECHNIQUES.items():
        needed = set(DEFENSIVE_CONTROLS[tid])
        covered = needed & set(applicant_controls)
        coverage = len(covered) / len(needed) if needed else 0.0
        residual = meta['freq'] * (1 - coverage)
        score += residual
    # 正規化 — 低いほど良好(0 best, 6 worst)
    return round(score, 3)

# グローバル主要保険会社 ransomware 支払い保障マトリックス (2026)
Insurer              Ransom Payment   OFAC Check  Negotiator Panel   IR Cost   Notes
-------------------  ---------------  ----------  -----------------  --------  --------------------------
Chubb                Up to 80%        Mandatory   Mandiant, Coveware Sublim    OFAC waiver pre-auth
AIG CyberEdge        Up to 75%        Mandatory   Kroll, GroupSense  Sublim    Cyber-One single policy
Beazley BBR          Up to 100%       Mandatory   Coveware, Arete    Outside   24/7 BM assigned
Coalition            Up to 100%       Mandatory   Coalition CIR      Outside   Active monitoring
Resilience           Up to 100%       Mandatory   Arete, Kivu        Outside   FAIR-based pricing
AXA XL               Up to 80%        Mandatory   Mandiant, Kroll    Sublim    NIS2 advisory included
Hiscox               Up to 70%        Mandatory   Coveware           Sublim    SME focus
Tokio Marine HCC     Up to 80%        Mandatory   Kroll, S-RM        Sublim    JP/US dual desk
サムスン火災         不担保           N/A         Igloo/AhnLab       含む      特金法と抵触
現代海上             不担保           N/A         SK Shieldus        含む      外国為替法と抵触
KB損保               不担保           N/A         Igloo/AhnLab       含む      VASPモジュール別途
東京海上日動         不担保           N/A         JPCERT/CC 連携      含む      NISCガイドライン準拠
損保ジャパン         不担保           N/A         SOMPOパネル        含む      中小企業特化