The Underwriting of Everything Post 1 title: The Black Box Post 1 subtitle: Three private companies, almost none of it disclosed, decide what your home is worth to a fire that hasn’t happened yet.

The Underwriting of Everything Post I of X  ·  Forensic System Architecture

The Black Box

Three private companies, almost none of it disclosed, decide what your home is worth to a fire that hasn't happened yet.

---

---

Randy Gipe · Claude / Anthropic  ·  2026  ·  Trium Publishing House Limited  ·  Forensic System Architecture

A control room of hurricane tracks, loss-exceedance curves, and modeled losses by county, bleeding through the roofline of an ordinary house with a "For Sale" sign in the yard. The house has no idea it is already a line item. Series header image — used across this archive's coverage of "The Underwriting of Everything."

Layer I  ·  Source

---

Somewhere in California or Florida right now, an insurance company is deciding whether to renew, raise the premium on, or simply decline to cover a house it has covered for years. That decision is not really being made by the insurance company. It is being made, several steps upstream, by one of three private firms whose names almost no policyholder has ever heard, using methodology that almost no regulator is allowed to fully see.

This series begins here, with the foundation everything else in it sits on, because the entire architecture of modern property insurance — who can get covered, what it costs, what happens when an insurer leaves a state entirely — now runs through a layer of private risk modeling that operates with less public disclosure than the weather forecast it's partly built from.

Layer II  ·  Conduit

---

Three companies dominate global catastrophe modeling: Moody's RMS, which Moody's Corporation acquired for roughly $2 billion in 2021; Verisk's AIR Worldwide; and CoreLogic. Between them, they model more than 100 perils — hurricanes, earthquakes, wildfires, floods, and increasingly war, political violence, and pandemic risk — across more than 100 countries. When an insurer prices a homeowner's policy, when a reinsurer prices a treaty covering an entire insurer's book, when a state regulator tries to determine whether a proposed rate increase is justified, the number nearly everyone in that chain is actually working from originated inside one of these three companies' proprietary software.

3

Private firms whose proprietary models price the majority of catastrophic risk globally

Moody's RMS, Verisk's AIR Worldwide, and CoreLogic. None is a public utility, a government agency, or subject to a uniform disclosure standard equivalent to what is required of, for example, a credit rating agency's published methodology.

"Proprietary" is the operative word, and it is worth sitting with exactly what it means in practice rather than treating it as an abstract business term. These models are built on assumptions about storm frequency, wildfire spread, soil composition, building codes, and climate trends that the companies do not publish in a form regulators, academics, or the public can independently audit. A regulator reviewing an insurer's proposed rate increase is, in many cases, being asked to bless a number whose actual derivation neither the regulator nor the public is allowed to fully inspect.

Who Actually Gets to See the Model

The same proprietary model output moves through several layers of the system. Access to the underlying methodology narrows sharply at almost every step.

Party

What They Receive

What They Don't Get to See

The
Modeling Firm

Full internal access to every assumption, parameter, and historical dataset underlying the model — the complete methodology, in full.

Nothing — this is the one party in the chain with complete visibility into what's actually being calculated and why.

The Insurer
or Reinsurer

Licensed model output — loss estimates, probable maximum loss figures, exceedance curves — sufficient to price a policy or treaty.

The underlying methodology in most cases, which remains the modeling firm's trade secret even from the paying customer using its output to set prices.

The State
Regulator

Summary model output submitted as part of a rate filing, sufficient in theory to evaluate whether a proposed rate is justified.

Full model access in most jurisdictions only under a non-disclosure agreement, and even then, a regulator's own representative can limit what information a consumer advocate intervening in the same proceeding is permitted to review.

The
Policyholder

A premium and, on request, a brief written explanation of the factors that influenced their specific rate.

Any access to the model itself, the data informing it, or any meaningful way to contest the number beyond the insurer's own appeals process.

Layer III  ·  Conversion

---

What gets converted here is judgment into proprietary code. A century ago, an insurance company's rate was set by an actuary working from publicly available loss history — imperfect, slow to update, but in principle inspectable by anyone with the patience to dig through the same records. Today, the rate is set by software whose internal logic belongs to a company with no regulatory obligation to publish it, reviewed by a regulator who agreed, as a condition of seeing it at all, not to disclose what they saw.

The model is not wrong because it's private. It might be the most accurate risk assessment available anywhere on earth. The problem is structural: an entire public system of insurance regulation now depends on a number that the public, and often the regulator, is contractually barred from examining.

The Underwriting of Everything · Series Analysis

This is not a uniquely American failure, and it is not a story of obvious villainy. The modeling firms did not seize this position by deception — they earned it by building genuinely sophisticated tools that insurers, reinsurers, and increasingly investors and even national governments have come to rely on because the alternative, less rigorous models, performed worse. The architecture's danger isn't competence. It's concentration: when three firms' proprietary assumptions effectively become the de facto public standard for pricing catastrophic risk everywhere, with no equivalent public model to check them against, "proprietary" stops being a normal trade secret and starts functioning closer to unaccountable infrastructure.

The Black Box — What the Record Shows

What was built

A concentrated, three-firm market in proprietary catastrophe modeling software, now functioning as the de facto pricing standard for property insurance, reinsurance, and increasingly sovereign and financial risk assessment worldwide.

Who built it

Moody's Corporation (via its $2 billion 2021 acquisition of RMS), Verisk Analytics (AIR Worldwide), and CoreLogic — all publicly traded or institutionally owned firms operating in an unregulated software market layered underneath a heavily regulated insurance industry.

Why it persists

Because the models are, by most accounts, genuinely good — sophisticated enough that insurers, reinsurers, and regulators have all come to depend on them rather than slower, less rigorous public alternatives. No comparable open or public model exists at the same level of sophistication to check their output against.

What FSA reads

A genuine governance gap hiding behind a genuine technical achievement. The model's accuracy is not the problem this post raises. The problem is that an entire regulatory system meant to protect the public from unjustified rate increases has, in important respects, been redesigned around a number the public is not permitted to see derived. The next post in this series follows what sits above this layer — the global reinsurance market that prices using these same models, at a scale and concentration of its own.

Layer IV  ·  Insulation

---

The insulation here is almost elegant in its simplicity: trade secret law was built to protect a company's competitive formula from a competitor, not to shield a de facto public pricing standard from the public it prices. Nobody designed catastrophe modeling to end up functioning as critical infrastructure. It got there gradually, the same way every concentration this archive has documented gets there — not through a single decision, but through years of insurers, reinsurers, and regulators all independently concluding that relying on these three firms' models was more rational than building or maintaining anything else.

That rationality, multiplied across an entire industry, is what makes this layer durable. There is no obvious villain to indict and no single decision to reverse. There is only a structural fact: the price of risk on your house, this year, traces back through your insurer, through its reinsurer, to a piece of proprietary software whose actual assumptions you are not allowed to see — and very possibly, neither is the regulator who approved the rate.

Sub Verbis · Vera.

FSA Wall — Post I · The Black Box

The three-firm catastrophe modeling market structure (Moody's RMS, Verisk's AIR Worldwide, CoreLogic), the $2 billion 2021 RMS acquisition by Moody's, and the characterization of limited public disclosure and independent validation of model methodology are drawn from industry and academic analysis of the catastrophe modeling sector. The description of California's regulatory access framework — full model review available to regulators only under non-disclosure agreement, with a state representative empowered to limit what proprietary information even an intervening consumer advocate may review — is drawn from reporting on California's 2024-25 Sustainable Insurance Strategy reforms, examined in greater detail in Posts III and IV of this series. This post's characterization of the "100+ perils, 100+ countries" modeling scope reflects industry-standard descriptions of these firms' combined market coverage; exact figures vary by source and year and should be treated as an order-of-magnitude characterization rather than a single audited figure.

The Underwriting of Everything  ·  Series Navigation

Post IThe Black Box

Post IIThe Concentration

Post IIIThe Mandate

Post IVThe Reversal

Post VThe Exodus