Articles - The evolution of terrorism risk modelling

By Weimeng Yeo, Head of Terrorism and Political Violence Analytics, Crisis Management, WTW

Over the past 25 years, however, the tools available to understand and model the risk have developed considerably. Terrorism modeling has moved from a strong focus on concentrations of exposure towards a broader analytical framework incorporating potential attack scenarios, probability, vulnerability and financial consequences.

Terrorism differs from natural catastrophe risk in one fundamental way: it is driven by people, not physical processes. That distinction has shaped how terrorism modeling has evolved over the past 25 years and why it remains a uniquely difficult peril to quantify.

Understanding where exposures were concentrated was only the first step. Exposure alone does not determine loss and accumulation is largely agnostic to peril. Two buildings the same distance from an attack can experience very different outcomes: weapon type and size, construction, occupancy, precise distance from the blast and insurance terms all materially change the eventual loss.

Translating exposure into potential loss pushed the industry toward deterministic terrorism scenarios. Rather than assuming everything within a defined radius was a total loss, insurers could simulate a specific attack and estimate its physical and financial consequences. Conventional bomb scenarios have been used as modeling benchmarks, while nuclear, chemical, biological and radiological (NCBR) scenarios enable insurers to explore less frequent but potentially more severe events.

The next evolution was probabilistic modeling. A deterministic scenario shows what might happen if a particular attack occurs at a particular location. Probabilistic modeling sets that scenario alongside the many other attacks that could occur, expressing terrorism risk as a distribution of potential losses rather than a single outcome.

These outputs support a range of insurance decisions, including pricing, accumulation management, limit setting and risk transfer. Probabilistic terrorism models can provide estimates of expected loss and the modeled likelihood of insurance layers attaching or exhausting, subject to the assumptions and limitations of the model.

Game theory offers one useful way of thinking about this problem. Terrorism is an interaction between attacker and defender: in game-theory models, increasing security around one target may reduce its relative attractiveness while making a less protected target comparatively more attractive. Terrorism risk cannot always be treated as a fixed probability assigned to a particular location. Game theory helps model how target attractiveness, attacker capability and defensive measures interact as conditions change.

Game-theory-based approaches also have limitations. Terrorist behavior is not always rational or consistent and information about motivations and capabilities is inevitably incomplete. Terrorism models provide a framework for quantifying uncertainty, not a precise forecast of where or when the next attack will occur.

The challenge extends to estimating financial consequences, which frequently reach far beyond physical structural damage. Modern low-tech attacks may cause relatively limited structural damage but still result in significant non-damage business interruption, denial of access and loss of attraction. Understanding terrorism risk now means looking past physical vulnerability to business disruption, authority responses and the financial impact that follows.

Detailed geospatial data can identify individual buildings and surrounding infrastructure. Global incident databases provide records of terrorism and political violence, while open-source information gives a richer and more current picture of how threats are evolving.

Artificial intelligence adds another dimension. AI and agentic systems process large volumes of structured and unstructured data and help analysts identify changes in activity, capability, targeting preferences, and geographic patterns.

This has implications for probabilistic modeling too. Estimating the likelihood of an attack remains one of its hardest components. AI does not remove that uncertainty, but it offers a more systematic way of processing information around intent, capability and threat. Combined with approaches such as game theory, AI could help analysts update probability assumptions more quickly as attacker behavior and the wider security environment change.

Greater computational power has also changed how the consequences of an attack are modeled. Earlier analysis often relied on standardized scenarios, such as a particular bomb size at a predefined location. More computational capability allows different weapon sizes, locations, and building characteristics to be modeled at higher resolution, giving a more detailed understanding of blast propagation, physical damage and financial loss.

The same applies to more complex NCBR terrorism scenarios, where the hazard footprint depends on atmospheric conditions, dispersion and the surrounding built environment.

Together, richer data and greater computational power can provide additional information for assessing terrorism risk. Richer information sharpens our understanding of the threat and how probability is assessed, while enhanced computational power and increasingly detailed exposure data sharpen our understanding of the consequences for insured assets.

At Willis, a WTW business, the Global Peril Diagnostic (GPD) provides one example of this approach, allowing terrorism and political violence events to be analyzed geographically and compared with client exposures, helping identify patterns and concentrations across an insured portfolio. Rather than viewing individual incidents in isolation, this can provide context around where events are occurring, how often they occur, the types of locations being affected and how those patterns intersect with a portfolio.

Scenario and probabilistic approaches quantify the potential consequences of severe events and identify concentrations that may not be apparent from historical experience alone.

Together, these approaches give different perspectives on terrorism risk. Historical experience and current threat information help us understand how the threat is evolving, while exposure analytics and terrorism modeling can indicate where a portfolio may be vulnerable and provide estimates of the potential financial materiality. For insurers and risk managers, this can support practical decisions around accumulation management, underwriting, limits and risk transfer.

Terrorism remains inherently difficult to quantify. What has changed in the last 25 years is the range of analytical tools available to assess it. Bringing these perspectives together can support a more informed assessment of where risk may be concentrated and the potential scale of modeled financial loss.