W. R. Berkley

sharing for my TA community

Underwriter – Property & Specialty Treaty 📍 London | Hybrid Looking to move from broking into underwriting? This is a rare opportunity to join a growing treaty team where you can shape your role and build your underwriting career. Why join us? 🌱 A blank canvas – help shape strategy and explore new lines of business 🌍 Global scope – work across international markets ✈️ Real exposure – travel, broker engagement, and industry visibility 🤝 Supportive team – collaborative, open, and genuinely inclusive 🚀 Career move – ideal for those transitioning from broking into underwriting The role Support the development of an international property & specialty treaty portfolio Review and price risks using data and modelling tools Build relationships with brokers and cedants Contribute to new business and growth initiatives About you Treaty reinsurance experience is essential (broking or underwriting) Keen to move into or develop within underwriting Commercially minded, analytical, and proactive Enjoys working collaboratively and bringing new ideas We’d especially love to hear from you if you’re: Looking to transition from broking into underwriting Motivated by growth, ownership, and long-term development https://lnkd.in/e3VxtmVa Excited by the opportunity to help build something new If this sounds like your next step, we’d love to hear from you.

⚠️ Security leaders: The window for proactive defense is closing faster than most realize. Just weeks after Anthropic’s Mythos Preview showcased autonomous zero-day discovery at scale, the real momentum has shifted to open-source communities and Chinese systems. Practical Mythos-level capabilities — high-volume vulnerability discovery paired with reliable exploit development — are now on track to reach open and affordable access in the next 2 to 4 months. Chinese cybersecurity teams at Qihoo 360 have already shown AI agents uncovering nearly 1,000 unknown vulnerabilities, including an eight-year-old critical Microsoft Office flaw found in minutes. Their AI-driven dominance in the recent Tianfu Cup exploit contests underscores the shift. Frontier models from DeepSeek, Qwen, and Zhipu continue rapid advances in coding, agentic performance, and cyber-relevant benchmarks. The practical gap is narrow and closing fast. Open-source ecosystems accelerate everything further. Through smart scaffolding, distillation, and monthly iteration cycles, even smaller models are already replicating targeted Mythos-style results on real bugs. The combination points to usable parity arriving by late summer or early fall. The implications hit hard and soon. When powerful vulnerability discovery tools become widely available at low cost, the time between finding a flaw and weaponizing it shrinks dramatically. Ransomware groups, state actors, and sophisticated criminals will gain fresh leverage. Supply chains, legacy systems, and production codebases all face rising exposure. Cyber insurance assumptions built on slower cycles will need immediate recalibration. Takeaway: Treat this as an urgent strategic inflection. Organizations that move now on AI-augmented defense, faster patching, vendor accountability, and resilient design will create real separation. Those who wait will spend the rest of the year catching up. The pace of progress favors those who act decisively today. Review your exposure, pressure your suppliers, and ready your teams for zero-days that surface at unprecedented velocity. #Cybersecurity #AISecurity #ZeroDay #CyberRisk #CISO #DigitalDefense #TechLeadership

⚠️LLM and Quantum Knowledge Synthesis⚠️ About a year ago I noticed something strange while piecing together ideas from various AI, quantum computing, applied physics podcasts. A pattern kept appearing so clearly that I could not let it go. Here is the clean mapping that finally clicked for me: 🤖LLM Token → Embedding (a vector) → sits inside d_model-dimensional space → allows superposition-like overlapping of meanings 🛸Quantum Basis state → Quantum state vector → sits inside Hilbert space → allows true superposition of possibilities A token is the basic building block in an LLM, just as a basis state is the basic unit in quantum mechanics. The token gets turned into an embedding, which is simply a vector of numbers whose length is d_model. That vector lives in a high-dimensional space and can carry many overlapping meanings at once. In quantum systems, a basis state expands into a full quantum state vector that can exist in true superposition across many possibilities inside a Hilbert space. d_model basically plays the role of the Hilbert space dimension for the LLM. Increase it as models get bigger, and you give concepts more room to coexist without as much interference. Even the training objectives line up in surprising ways, with similar loss functions appearing in both classical embeddings and hybrid quantum-classical setups. The underlying geometry of vectors and inner products feels shared. Proof that I’m not alone ➡️Anthropic’s “Toy Models of Superposition” from 2022 borrowed quantum terminology on purpose to describe exactly this in neural networks. Models pack far more features than dimensions, which creates polysemantic representations through overlapping superposed features. ➡️Newer papers go even further. For example: “The Quantum LLM: Modeling Semantic Spaces with Complex Hilbert Spaces” models the semantic space of LLMs as complex Hilbert spaces built directly on the embedding vectors, including interference effects. What started as me casually synthesizing podcast fragments ended up landing right on the frontier where AI interpretability and quantum machine learning meet. Researchers have already turned them into practical tools. Anthropic uses the superposition idea to train sparse autoencoders that “unsuperpose” tangled features in real LLMs, making models far more interpretable and safer to audit. Other teams treat embedding spaces as complex Hilbert spaces, building hybrid quantum-classical layers that improve robustness against adversarial attacks and deliver better results on scientific modeling tasks like fluid dynamics and molecular design. These are concrete engineering wins, not just theory. To add clarity to what I am saying: I noticed a persistent overlap between transformer technology and quantum mechanics. What seem like completely distinct fields actually share remarkable, deep similarities. #AI #QuantumComputing #LargeLanguageModels #Interpretability #Superposition #vectors #tokens

⚠️ Anthropic’s latest messaging on AI safety has me raising a skeptical kitty eyebrow. 🐈⬛ On one hand, they’ve developed Claude Mythos, a frontier model so capable at discovering vulnerabilities that they’ve restricted it under Project Glasswing. Access is tightly controlled and shared only with a select group of trusted partners. Why? Because, in their own words, this level of offensive cyber capability could represent “unchecked power” if it fell into the wrong hands. They’re positioning themselves as responsible stewards, giving defenders a head start before the technology proliferates. Fair enough. Caution with powerful dual-use tools is prudent. On the other hand, when independent researchers at OX Security disclosed a systemic, architectural command injection and RCE vulnerability baked into the core of Anthropic’s own Model Context Protocol (MCP), affecting potentially 150M+ downloads and up to 200k servers across the AI agent ecosystem, the response was markedly different. Anthropic’s position: “This is expected behavior by design.” The STDIO execution model is apparently a “secure default,” and input sanitization and secure implementation are entirely the responsibility of downstream developers. They declined to make fundamental changes to the protocol itself, opting instead for a quiet update to their security guidance suggesting users exercise “caution.” So let me get this straight: 🤪 When your model finds vulns in everyone else’s code, it’s so dangerous we must gatekeep it heavily. 🤪 When researchers find a real, exploitable flaw in your own protocol that propagates through the entire supply chain, “Not our problem, code better.” “By design” has never been a particularly compelling defense when the design predictably leads to widespread remote code execution risks. Especially not from a company that just launched a high-profile initiative to secure critical software for the AI era. Secure-by-default shouldn’t be optional when you’re building foundational infrastructure for autonomous agents. The ecosystem deserves better than selective responsibility. >>>> Link to Hackernews article in comments #AISecurity #Cybersecurity #MCP #ResponsibleAI #SupplyChainSecurity

⚠️ AI Changed The Tempo. Our Risk Thinking Hasn’t Caught Up. Here Is To You John Boyd. ⚠️ I’ve been reflecting on a recent discussion about AI and cyber risk that exposed something deeper than the specific disagreement we were having. The position I heard was familiar: a vulnerability is a vulnerability. Whether it’s found by a person or an AI model, the risk hasn’t really changed. That conclusion follows cleanly from the classic risk equation many of us still rely on: Likelihood X Impact. That equation, however, was built on assumptions that are no longer stable. It assumes time is abundant, decision windows are predictable, and human response remains viable before consequences occur. Those assumptions held when threats moved at human speed. They erode when threats operate at machine speed. AI is not simply increasing the pace of discovery and exploitation. It is compressing the time between those steps to the point where speed and velocity shape whether risk can be controlled at all. They now materially affect outcomes. When attackers act faster than an organization can observe, make sense of what’s happening, and intervene, the nature of the risk changes even if the weakness itself stays the same. In that situation, likelihood is no longer an abstract estimate based on exploitability or threat interest. It becomes a question of whether any meaningful control can still be applied before consequences occur. Once response time shrinks past that point, outcomes are no longer determined by the vulnerability on paper. They are determined by whether the system still has the ability to exert control at speed. This pattern is well understood in other domains. As systems become faster, failure modes move away from component defects and toward loss of control. Engineers worry less about whether something can fail and more about whether it can be governed once it starts moving. Cybersecurity is entering that same phase. When speed outpaces decision and authority, risk is no longer defined by the weakness itself. It is defined by whether control still exists. That’s why “we’ll automate” is not a complete answer. Automation can increase velocity further and expand the blast radius if authority, constraints, and intent are not designed first. The harder problem is controlling speed: deciding what actions are permitted at machine pace, where friction must exist, and where human judgment still matters. Those are risk decisions before they are engineering ones. Risk models that cannot express these limits will continue to produce confident assessments that no longer match operational reality. #risk #cyberrisk #ai #ooda #security #businessrisk #regulation #control

Pippa Takes on Fort Worth! This past week, Asray Gopa and I had the incredible opportunity to travel to the TCU Neeley School of Business to compete in the 2026 TCU Values and Ventures® Competition. Out of 250+ global applicants, we were honored to be among the teams selected, to pitch Pippa , our virtual pet app helping users build consistent eating behaviors. Representing Iowa State University alongside some of the most innovative student founders in the world was an unforgettable experience. The energy in the room was electric, and the feedback we received was invaluable: 1️⃣: Validation: It was rewarding to hear such positive feedback from judges and peers on Pippa’s mission to support anorexia recovery by turning eating into an act of care rather than a source of fear. 2️⃣: Growth: We walked away with a much sharper vision for our pitch deck and a better understanding of how to communicate our impact. 3️⃣: Connection: Between sessions, we had a blast hanging out with the other contestants. It’s inspiring to be surrounded by people building the future. While the competition was fierce, the community was even stronger. We left Fort Worth with new mentors, new friends, and a lot of momentum to keep building. A huge thank you to Texas Christian University for their incredible hospitality and the ISU Pappajohn Center for Entrepreneurship (JPEC) for their generosity and support in getting us there. We’re back in Ames and more motivated than ever. Stay tuned; Pippa is just getting started! #Pippa #Entrepreneurship #TCUValuesAndVentures2026 #Cyclones #StartupLife #AIWellness

⚠️ Continuous Pen Testing In recent conversations around evolving cybersecurity practices, the topic of automated continuous penetration testing stood out as one approach organizations are exploring to address the pace of change in today’s threat landscape. Platforms in this category combine AI-driven automation with graph-based attack path mapping and adversary emulation techniques. They autonomously discover assets across networks, cloud environments, applications, identities; and simulate realistic attack chains. This creates a more ongoing, scalable layer of validation compared to traditional methods. For context, this differs from regular manual penetration testing, which typically involves skilled human experts delivering in-depth assessments on a periodic basis - often annually, quarterly, or after significant updates. Manual testing remains valuable for uncovering nuanced business logic issues and context-specific risks that benefit from adaptive human insight. Developments such as Anthropic’s Claude Mythos have added perspective, showing how AI models can autonomously identify and chain large numbers of vulnerabilities across operating systems, browsers, and enterprise software. Now where threats can evolve rapidly, periodic point-in-time testing alone may leave gaps, which is why continuous validation methods are receiving more attention. On the operational side, vulnerability management and patching teams handle the increased volume of findings through risk-based prioritization by focusing on validated, high-impact attack paths rather than every potential issue. This approach aligns closely Continuous Threat Exposure Management (CTEM) framework, particularly in the observation and validation stage, where exposures are confirmed as real and exploitable before remediation priorities are set. From a governance viewpoint, these capabilities can support compliance efforts under frameworks like NYDFS Part 500 (which calls for annual testing plus risk-based frequency), Singapore MAS Technology Risk Management Guidelines, and UK/EU regulations such as NIS2 and DORA, which emphasize proportionate, ongoing technical measures and effectiveness testing. Cyber insurers also tend to look favorably on evidence of proactive control validation when assessing organizational risk. Leading specialized platforms include pure-automation options such as Pentera and Horizon3. ai (NodeZero), Cymulate, Picus Security, and BreachLock; and hybrid managed offerings like those from UltraViolet Cyber. UltraViolet, for example, combines automation with proprietary post-exploitation toolkits, real-world TTPs, and red-team expertise, while integrating with broader MDR and SOC services. For CEOs and boards, it can be useful to view this area through an enterprise risk lens such as how it contributes to operational resilience, and reduces business risk. #Cybersecurity #RiskManagement #CTEM #risk #pentest

⚠️ Post-Mythos Impact on Cost of Capital and Credit Spreads In the post-Mythos era, companies that fail to adopt continuous observation, detection, and prioritization technologies (such as mature CTEM capabilities or equivalent risk-based programs) will face materially higher cost of capital and wider credit spreads. The shift from “discovery is hard” to “discovery is now fast, scalable, and exhaustive” fundamentally redefines prudent governance. Legacy approaches built on periodic scans and CVSS scoring are increasingly viewed as insufficient for managing foreseeable risks, creating a clear governance shortfall in the eyes of credit rating agencies, lenders, and institutional investors. Even as the broad ESG label has been de-emphasized by major asset managers like BlackRock, the underlying governance signal remains robust. It has simply migrated to a more focused set of criteria: operational resilience, enterprise risk management, AI-era risk oversight, and board-level accountability for emerging technological threats. Moody’s 2026 Cyber Risk Outlook explicitly highlights that AI tools are intensifying threats and that companies lacking strong governance around AI-driven defenses will be increasingly vulnerable, with cyber risk now factored more directly into credit assessments when material. Rating agencies already incorporate cyber maturity into their analysis; non-adopters can expect downward pressure on ratings or outlook revisions. This frequently translates into wider credit spreads, often in the range of 10–30+ basis points for investment-grade issuers, depending on sector and leverage, and a higher overall cost of both debt and equity. Even modest spread widening of this magnitude can materially increase the all-in cost of capital, turning what might have been a near-flat financing round into millions, or tens of millions, in additional interest expense over the life of a loan or facility. In a post-Mythos world, failure to implement continuous observation, detection, and prioritization technologies directly raises a company’s cost of capital by increasing perceived governance and operational risk. Rating agencies and lenders now view lagging cyber programs as a foreseeable weakness rather than an unknowable risk, which can add meaningful basis points to borrowing costs and elevate the required return for equity investors. The effect compounds through higher insurance premiums, potential regulatory scrutiny, and direct impacts on cash flows and balance-sheet metrics. In practice, the market continues to reward companies that demonstrate proactive adaptation to the new paradigm of AI-scale discovery while penalizing those anchored in pre-Mythos assumptions. For boards and finance leadership: investment in continuous risk observation, intelligent prioritization, and validation is no longer purely a security expense as it has become a core capital-structure and valuation imperative. #ai #finance #security #mythos #insurance #ESG #risk