Editors’ Note

Karen White is an accomplished leader in the technology industry with a 25-year track record of leading, innovating, and scaling global technology businesses. She is an expert at bringing technology, innovation, data, and operations together to help drive digital transformation. White started her career in Silicon Valley as a senior executive at Oracle reporting to CEO Larry Ellison. Most recently, she was President and COO at Addepar, a leading fintech company serving the investment management industry with data and analytics solutions that are replacing decades old legacy systems with leading-edge tech. Prior to Addepar, she was CEO and Chairman of the Board at Syncplicity, a leading enterprise file sync and management SaaS business aimed at enterprises as well as the mid-market. Previously, White led worldwide corporate and business development at SolarWinds, a top IT and network management software company whose customers included the Fortune 500. She is currently on the Board of Directors at Varo Money.

Company Brief

For more than 30 years, RMS (rms.com) has led the way in transforming the catastrophe risk industry, helping organizations make better decisions to improve human and environmental outcomes. By combining proven modeling science with powerful advances in technology, RMS Risk Intelligence solutions enables clients to better assess risk and reduce uncertainty. From extreme weather to climate change to other catastrophes, RMS helps understand risk, integrate predictive analytics, and share its expertise to help to build a more resilient world.

Will you provide an overview of RMS and what have been the keys to its strength and leadership?

RMS is in the business of risk. We’re the global leader in catastrophe risk modeling and analytics. About 85 percent of the Lloyds of London market, and a majority of P&C insurers, reinsurers and brokers globally, leverage our catastrophe risk models in mission-critical parts of their businesses and in that way, we influence risk mitigation and resiliency of most enterprises and property owners in the world for the many slices of risk we model. Our science, data and tech underlie the $1.6 trillion P&C market worldwide. We also serve governments, as well as capital and financial markets, with more enterprises knocking on our door over the past years as anticipating and managing complex risks becomes more front and center for CEOs and boards in general. It is clear that what we understand about the impacts of risks has a lot of utility beyond the insurance and financial markets we’ve traditionally served.

RMS models everything from climate change, extreme weather events like hurricanes and floods, to cyber and terrorist attacks, earthquakes and pandemics. Importantly, we model not just the peril itself, but the financial losses and other impacts of those risks in service of helping our clients manage what we think of as risk life cycles. Over 30 years, we’ve developed 400 models along with rich, underlying risk data and analytics. We’ve grown to have a deep understanding of the physics of risks and we’re constantly evolving how to apply that to real-world risk challenges.

What sets us apart is our obsession with innovation, rooted in the best science and tech, with a singular focus on risk. Turning that obsession into meaningful, practical risk models, analytics and solutions, is our purpose. Risk has always been complicated, but in today’s global economy it is more complex, connected and tricky to understand and mitigate for. You can’t get there without harnessing tech in whole new ways, and doing that well. We invest far more of our capital in R&D than anyone else in our market and we invest a higher portion of our capital than the typical tech company in R&D as well. We’re walking the talk in that way. We have hundreds of top data scientists, PhDs, software engineers and modelers who are incredibly driven by our mission.

Has the pandemic impacted how the world thinks about risk and resiliency and what are some of the other risks the world needs to be thinking about?

The pandemic has accelerated a collective global turn to risk and resiliency. We now know what we don’t know, and what we don’t know has made us incredibly vulnerable. The connectedness and the complexity of modern risks across the globe have been laid bare by the pandemic in new ways. It’s forcing us to think differently about risk impacts and how to pre-empt them. The impact of COVID-19 will be indelible, but the question is, “Now what?”

The pandemic holds the potential to accelerate industry transformations, including digital transformations and reliance on deeper analytics to drive our risk decisions and imbed new tech into important aspects of our enterprises going forward, taking into account systemic and other risks in new ways. Instead of becoming a compliance and theoretical exercise, this can be turned into a competitive advantage and actual greater resiliency. In many boardrooms, COVID-19 has led to climate change risks being more front and center as well. This is because everyone is working to get their heads around the full breadth of their risks, existential and otherwise, and is thinking a lot harder about the opportunity to build better resiliency and the real consequences of not doing do.

The pandemic will pass, but climate change will be the pandemic that never ends. There are $2 trillion of commercial and residential properties in the world near a coastline, impacted by rising sea levels. That’s going to have real impacts. We modelled a hurricane mega-event that showed $240 billion in damages – property, liability, workers comp, energy and more – from a single event. Investors are starting to mandate ESG and sustainability as investment criteria, demanding more transparency and investments in that area. Regulators are increasingly focused on climate change stress testing. The economic impacts of climate change could dwarf those of the pandemic.

Cyber risks, and business interruption, driven by global connectedness, are getting closer looks as well. Damage related to cybercrime is expected to hit a staggering $6 trillion in the next year or two. The insurance industry is writing no more than $7 billion in premiums against that risk today. Twenty years into the cyber insurance market and it is still only about 1 percent of the size of the property insurance market. We’ve been slow on the draw to hedge for future risk resilience. Cyber is a mind-numbing exposure and one of the ultimate protection gaps. Watching just ransomware evolve over the past years, we can see that we may be closer to ground zero than to optimum resilience around cyber threats.

A few years ago, Warren Buffet talked about a potential $400 billion mega-catastrophe event, highlighting Berkshire Hathaway’s ability to sustain it. That possibility was dismissed as only theoretical by some, until COVID-19 brought it to life, before we even speak about the devastating nature of this health crisis and the tragic loss of life.

There are a lot of lessons to be learned from the pandemic that we can apply to other risks. For the past year I’ve been calling out ten future risks we need to care about: cyber, climate change and pandemics/infectious diseases are at the top of this list.

Will you discuss your thoughts on technology and risk, and how industries are ripe for transformation?

I’ve always tried to focus on that moment in time when the dynamics of an industry are mandating change, even if the legacy industry is resisting hard, and technology has evolved to propel that change forward in new ways. That’s when transformations happen. The companies I’ve helped to lead have collectively grown in market cap by more than $165 billion. Driving or riding those waves of change and transformation can be awfully lucrative. On the other hand, these transformations are often ruthlessly unkind to incumbents and I’m always challenging us to understand when it’s time to disrupt ourselves before someone else comes along and does it for us.

In my early career in Silicon Valley at Oracle, I worked for Larry Ellison, starting at a time when there were only 50 websites in the world. Among other things, we shifted from client-server to internet computing, and with that, saw the e-commerce business grow from zero to now more than $3 trillion, saw the transformation of virtually every business on the planet, and the shape of the global economy changed from all of that. Before RMS, I was at Addepar. We were this little start-up with a great idea to give better tech-driven analytics and insights into investments, leveraging models and tech in new ways. The incumbents were not so sure. Fast forward to now, and nearly $2 trillion in assets are on that platform.

I believe that risk markets – insurance and financial among them – are at that moment of transformation. The market dynamics are all pointing to it and technology has evolved and can accelerate the change. I think this will ultimately lead to new risk, insurance and financial products, and a meaningful change around how enterprises are able to leverage risk data and analytics to deliver just-in-time along with longer-term risk insights, leading to greater resiliency.

The world has an e-commerce platform, a search platform, a social media platform, and mobility platforms, but the world doesn’t have a global risk platform. I think it’s about time. We’ve been expanding on our core catastrophe risk model business down that risk cloud platform path for the past few years and we’re pretty excited about what the next five years could hold.

How do you define resilience and how critical is resilience to RMS’ business?

Resilience is the ability to recover rapidly and well after a setback. Resilience is not simply about demonstrating compliance. Focusing on the best understanding and data-driven insights around risks and resiliency for our customers is core to our particular business so in a sense, better resilience is ultimately our product. We can think of being resilient to a specific class of incident – everything on our risk registers and for us, every catastrophe we model. But how many companies included a global pandemic as their biggest economic risk or even among their potential risks?

In another example, statistics for years said it was safe to write property insurance in drought-plagued California, going on past years’ claims data. Confident in past claims data to predict the future, some policies were priced in a particular way and then 2017 happened – $17 billion of losses from the wildfires coupled with a multibillion-dollar liability, lawsuits and, ultimately, bankruptcy for PG&E. Our stochastic event probabilistic wildfire model told a different story than the past claims data, one example of how modelling and tech can be leveraged for better outcomes than relying on recent trend data.

Intellectually we all get that the past is not always the best predictor of the future and that this is particularly true of risk, but putting that into practice in our businesses is challenging. I think recency bias plays a huge role in our ability to properly assess risks. Part of resiliency is coming to terms with that. The more powerful resilience is not incident-specific, but is resilient to whatever gets thrown at us, including incidents that have not been previously identified. This is the capacity for resilience that has to be built into the culture of an organization.

We can be much better prepared if we have identified and modelled the full range of potential catastrophes, which is why our work includes “looking around corners,” thought leadership, scenario planning, and anticipating the events which have not been part of our recent experience and measuring their potential impacts and mitigations. We all have limited resources. Resiliency and risk mitigation can be costly and it’s challenging to focus risk mitigation and resiliency dollars in all the right places. Technology will be playing a bigger and bigger role in that.

Insurance can also be a key component of resilience, rapidly providing funds to the insured after a damaging or business-impacting incident, so as to enable recovery. RMS has the critical mission to make insurers more resilient so that they can successfully perform their function. The same applies to helping make a city or country more resilient to shocks. One relevant example is that we have been building probabilistic models for pandemic impacts on the Life and Health sectors since 2007. Our first probabilistic pandemic business interruption (BI) model was developed in 2008. The challenge of thinking ahead is often that, because there is no recent experience, there may also be little demand. In 2008 it was hard to find an insurer who wanted insights into or to write pandemic BI coverage. There was no enterprise market demand. That is clearly not the case in 2020/2021.

How has resilience impacted your work?

At RMS we try to live by the precepts of being a resilient organization, while at the same time having a focus on providing the tools that enable our clients to be resilient. We are a cloud-first company with risk in our DNA and strong tech, so getting employees across the globe into productive work from home situations was straightforward. We haven’t missed a beat so far and we’ve met our financial plan through the crisis, continuing to hire at the same pace.

Lately, there are days that make you step back and think. There’s the global pandemic, then temperatures in California hit triple digits recently, we all woke up in the middle of the night to thunderstorms that shook our houses, sending thousands of lightning bolts down causing fires all over the place. Scheduled and random power outages ensued, but you can’t leave town because of the pandemic, you can’t run your AC because of power issues, you can’t open your windows because of heavy smoke, and you can’t sleep between the heat, the smell, the thunderstorms and, for me, checking in on the uncontained wildfire burning through 77,000 acres where climate change played a role, which was just 18 miles from my house with a 60 mile per hour storm coming in over it, blowing towards my place. We soldier on, right?

As an example of resilience in action when you’re a risk company, we have a team prepared 24/7 to respond to catastrophes as they happen, for example to rapidly develop a footprint of the properties, values, and levels of damage in a port explosion in Beirut. Our function is to help our clients in quickly determining the financial impact on their own balance sheets, in part so they can demonstrate their own resilience to investors and regulators. It’s awesome having specialty risk teams under the roof – no other CEO in my circles had a global pandemic team to help them respond to what was happening and see a few weeks and months out so we started putting out reports to help others with their own company planning, when normally that model is used for life risks within insurance companies.

One example of how we prepare for catastrophe response is that in order to measure the impact of a catastrophe, we need to know the building stock, how susceptible is it to damage, what precautions have been taken, and how much of it is insured. We can’t wait for a catastrophe to happen to collect this data. In 2015, we sent a team of engineers to do field surveys in the northeast Caribbean, working with local insurers and their engineers so that we knew the answers to all these questions in advance. In responding to the latest hurricane, we also need to have the best information on the wind field of the storm in real time. This used to be provided by an agency of NOAA, in a product called HURDAT. The opportunity came for RMS to acquire this capability so that now we are the providers of the most accurate hurricane wind fields, integrating all other data sources. This, by the way, will help us understand one aspect of climate change impacts. In 2017, Hurricane Maria made a direct hit on the island of Puerto Rico. All the wind speed recorders on the island were knocked out by the storm. By combining the HURDAT wind fields with our own findings on the buildings and insurance, we were able to provide robust loss estimates. Our figures were less than half of the wild and vastly incorrect estimates made by another modeler, which if correct would have led to many of the island’s insurers going out of business. Our preparations had enabled us to manifest resilience and to empower our clients to demonstrate their own resilience to an unprecedented catastrophe.

Resilience concerns moving the company to handle a wide range of potential, credible incidents and threats, showing it can navigate them successfully and finding where shoring up of some nature is required before that vulnerability causes undue harm. Businesses differentiate themselves in their ability to respond to a crisis. RMS is a trusted party in understanding risks and building resilience.

Do you feel that resilience is something a person is born with or can it be taught?

I think some are born with innate qualities that make them better suited to resilience. For me, the worse things get, the calmer I am, but that’s just in my nature. I also think there is always room to get better so sure, better resilience and rolling with the punches can be taught, which is so critical with all that’s going on in the world right now.