Treatise 06: Non-Linear Cyber Risk Underwriting Methodology

J. McKenney

This is a working-group treatise in WG-01-UI (Underwriter & Insurance) that introduces the Cyber Digital Twin architecture named in the working group's introductory overview, WG-01-UI-1-Overview. Later treatises in the group, including the Concept of Operations and Minimum Operating Requirements paper and the RCIL/SCIL reinsurance paper, build directly on the digital twin and the CyHAZOP methodology this paper introduces in Section 2.

Licence: CC BY 4.0. 17 September 2026.

Executive Abstract#

Cyber insurance for critical infrastructure has a measurement problem. The standard tool, a point-in-time questionnaire, samples what a policyholder says about its own controls once a year, while the real risk is set by physical equipment that changes state continuously and that the policyholder often cannot enumerate. The paper proposes the Cyber Digital Twin: a physics-based model of the plant's process fused with live sensor telemetry, so risk is measured continuously rather than sampled.

The central comparison is telematics in auto insurance, where a device reporting actual driving replaced demographic guesses about safe drivers. The twin does the same for a factory or grid, using process-industry safety methods, including a cyber-adapted hazard and operability study called CyHAZOP, to translate a network intrusion into the physical consequence it would produce rather than a severity score.

The rest works out what the measurement is worth to an underwriter setting premium and terms, a broker like Aon fitting the output to a Total Cost of Risk framework, and a reinsurer like Munich Re bounding its book's exposure to a single systemic vulnerability. Two distinctions recur: telemetry measured from the live plant is not a simulated attack's projected impact, and a broker's negotiating narrative is not a claims-history statistic.

Abstract#

The cyber insurance market strains because traditional underwriting does not carry across to operational technology: point-in-time questionnaires, compliance checklists, and external scans sample a policyholder's account of its controls at one instant, while an OT plant's risk is set by physical state that changes continuously and by equipment the policyholder often cannot enumerate. In breweries, energy grids, manufacturing plants, and automated greenhouses, the convergence of legacy ICS with IoT creates an opaque attack surface where intrusions cascade into physical damage, business interruption, and life-safety hazards. Cyber risk does not follow normal distributions but shows systemic accumulation and fat-tail events: cybercrime's global cost is projected to reach $13.82 trillion by 2028 and the average breach near $4.4 million, though physical disruption often runs higher. The remedy is the Cyber Digital Twin, the industrial equivalent of telematics: physics-based facility models fused with real-time sensor telemetry give a continuous, inside-out view of resilience. Augmented with macroeconomic threat intelligence, psychometric profiling of threat actors, and attack-likelihood prediction over a 90-day horizon, it yields a dynamic cyber resilience credit rating. The report details the architecture, CyHAZOP safety integration, and actuarial implications, mapping the twin's outputs to the underwriting lexicons of Aon and Munich Re through frameworks such as Total Cost of Risk (TCOR) and CORA-OT to flatten the fat tail and enable usage-based cyber insurance for critical infrastructure.

1. Architectural Foundations of the OT Cyber Digital Twin#

The conventional understanding of a digital twin within the manufacturing and heavy industry sectors centers on process optimization, predictive maintenance, and lifecycle management. These traditional models ingest sensor data to replicate physical processes, allowing engineers to predict when a bearing might fail, how a change in temperature will impact production yields in a commercial greenhouse, or how to balance load distribution across an energy grid. However, transitioning the digital twin from a purely operational construct to a comprehensive "cyber use case" requires a multidimensional architecture that maps not only the laws of physics but also the logic of digital control systems, network topographies, and software vulnerabilities.

Fundamentally, a highly advanced cyber digital twin for critical infrastructure is constructed upon two foundational pillars: the process twin and the device twin. The process twin models the industrial operations themselves, capturing the intricate physical behaviors of machinery, thermodynamic limits, fluid dynamics, and automated production lines. This physics-based modeling is vital because a cyberattack on an OT environment ultimately manifests as anomalous physical behavior. If an attacker manipulates a programmable logic controller (PLC) to report false pressure readings to a human-machine interface (HMI) while simultaneously driving a pump beyond its safe operating limits, the process twin will detect the thermodynamic impossibility of the falsified data, flagging a severe anomaly that traditional network monitoring might miss.

The device twin complements this physical mapping by replicating the individual industrial components; PLCs, remote terminal units (RTUs), HMIs, and embedded sensors; down to their firmware and configuration levels. For large multinational organizations, maintaining an exhaustive inventory of these assets is a notoriously difficult challenge. The cyber digital twin solves this by ingesting and dynamically maintaining Software Bills of Materials (SBOMs) for all equipment. By mapping the precise software composition, firmware versions, and hardware configurations of every asset, the twin creates a deterministic map of the facility's vulnerability surface. Security teams can execute firmware analyses and simulate the deployment of patches within the virtual environment, identifying potential operational disruptions without risking the uptime of the physical plant.

To function as a live, diagnostic entity rather than a static model, the cyber digital twin must maintain a state of continuous synchronization with the physical facility. This is achieved through the ingestion of active telemetry from a diverse ecosystem of OT and IT security tools. By integrating feeds from deep packet inspection and asset discovery tools like Nozomi and Dragos, alongside IT-centric aggregators like Splunk, Active Directory, and operational data historians, the twin constructs a unified, real-time representation of the environment's state. Splunk provides security information and event management (SIEM) logging, Active Directory maps identity and access management vectors, Dragos and Nozomi parse the proprietary protocols of the OT network, and historians provide the time-series data of the physical state. This telemetry provides the raw material for continuous behavioral baselining, allowing machine learning algorithms to map the normal communication patterns, access requests, and command executions within the facility. Any deviation from these highly structured baselines; whether a sudden influx of lateral movement requests from an engineering workstation or an unauthorized firmware update pushed to a safety controller; is instantly flagged, quantified, and modeled for its potential impact.

The integration of these disparate data streams allows the digital twin to perform sophisticated attack simulations in a completely safe, offline ecosystem. Security and operations teams can subject the virtual facility to thousands of probabilistic attack vectors, observing how a specific piece of ransomware might traverse the network, bypass segmentation controls, and ultimately interact with the physical machinery. By analyzing the structural resilience of the facility against both known and theoretical exploits, the cyber digital twin transitions the organization from a reactive security posture to a state of proactive, mathematically grounded cyber resilience. This forms the foundation of a new underwriting methodology, substituting annual questionnaires with continuous operational telemetry read from the live plant. The telemetry is measured. What the twin then does with it, the attack simulation and the impact quantification, is modeled, and the two should be reported separately to an underwriter rather than merged into a single score.

2. Bridging Cyber Threats and Safety Engineering Disciplines#

The transition from purely digital risk assessment to an understanding of physical consequences requires the integration of traditional safety engineering and reliability engineering disciplines. In critical infrastructure, cyber risk is not confined to data exfiltration or privacy breaches; it extends directly to physical destruction, environmental contamination, and human casualties. Therefore, a robust cyber digital twin must translate digital vulnerabilities into the language of safety, aligning with established engineering frameworks such as IEC 62443 for industrial cybersecurity and IEC 61511 for functional safety.

Central to this alignment is the modernization of the Hazard and Operability (HAZOP) study. Developed in the chemical industry to systematically identify operational deviations and hazards, the traditional HAZOP methodology has long been the gold standard for process safety. However, traditional HAZOPs typically assume random component failures rather than intelligent, malicious exploitation. The cyber digital twin facilitates the execution of a "Cyber HAZOP" (CyHAZOP), which introduces specific cybersecurity guidewords and deviations into the safety assessment process. By applying the twin's deep visibility into network topologies and device interactions, engineers can systematically evaluate how cyber threats might compromise the facility's Safety Instrumented Systems (SIS); the final layer of automated defense designed to shut down hazardous processes before a catastrophic event occurs.

The historical precedent for this approach is stark. The 2017 TRITON malware attack on a Middle Eastern petrochemical plant specifically targeted the facility's SIS, altering the firmware of the safety controllers in an attempt to disable the fail-safes and trigger a physical catastrophe. This watershed event fundamentally erased the boundary between cybersecurity and physical safety. The cyber digital twin mitigates this risk by rigorously simulating attack paths that target the SIS, verifying that control logic has not been tampered with and ensuring that the Minimum Operating Requirements (MOR) for safety can be maintained even under intense digital duress.

In addition, the twin deeply integrates with the facility's hazard log and reliability engineering protocols. As the system continuously monitors telemetry and identifies deviations, it dynamically updates the probability of occurrence for specific physical hazards documented in the log. If a new vulnerability, quantified by a high Exploit Prediction Scoring System (EPSS) score or identified within the Common Vulnerabilities and Exposures (CVE) database, is discovered that affects the specific firmware version of a valve controller mapped in the twin's SBOM, the system instantly calculates the new risk profile. It evaluates whether an attacker could exploit this Common Weakness Enumeration (CWE) to force a "More Pressure" or "Less Flow" deviation within the physical process twin.

By quantifying the potential business interruption, equipment damage, and safety implications of these cyber-physical scenarios, the digital twin bridges the gap between IT security metrics and the stringent, deterministic world of industrial safety engineering. This physical modeling is what differentiates a true cyber digital twin from a standard security posture management tool; it translates network behavior into tangible physical outcomes, providing insurance underwriters with precise data regarding maximum foreseeable loss and probable maximum loss scenarios.

3. Outside-In#

Macroeconomic Surveillance and Vulnerability Intelligence

While the cyber digital twin provides unparalleled "inside-out" visibility, a comprehensive assessment of cyber resilience requires continuous monitoring of the "outside-in" threat landscape. Cyberattacks do not occur in a vacuum; they are perpetrated by highly motivated, often state-sponsored or organized criminal syndicates operating within complex geopolitical and macroeconomic contexts. To predict if a facility is likely to be targeted, the digital twin ecosystem must incorporate advanced external intelligence gathering, tracking specific tactics, techniques, and procedures (TTPs) and deconstructing historical incidents.

The external monitoring apparatus begins with macroeconomic and geopolitical indicators. State-sponsored attacks and advanced persistent threats (APTs) are frequently correlated with escalating geopolitical tensions, economic sanctions, or regional conflicts. Historical precedents, such as the Costa Rica ransomware attack that inflicted losses equivalent to nearly 2.4 percent of the country's GDP, or the 2017 NotPetya attack that caused supply chain disruptions four times greater than the losses faced by directly affected firms, demonstrate the profound macroeconomic ripple effects of cyber warfare. By tracking these macro trends, the system can identify shifting threat vectors and assess the broader systemic risk environment.

Simultaneously, the system ingests granular threat intelligence. It watches vulnerabilities through feeds like EPSS, CVE, and CWE, continuously matching these external threat indicators against the internal SBOM data maintained by the device twin. If a new CVE is published, the digital twin immediately scans its repository of virtualized equipment configurations to determine exposure. In addition, the system tracks specific TTPs mapped to frameworks like MITRE ATT&CK, observing the methods employed in recent cyber incidents across similar industrial sectors. By deconstructing these incidents, the system understands the specific capabilities of various threat actors; for instance, recognizing if a specific group specializes in compromising historian servers to manipulate telemetry, or if they prefer deploying ransomware against engineering workstations.

This outside-in intelligence is actively merged with the physical simulations. If the external surveillance module detects an uptick in attacks using a specific protocol exploitation technique against energy distribution grids, the digital twin can automatically construct a simulation using those exact TTPs against its own physics-based model. This allows the organization to observe precisely how a trending, real-world attack would manifest within their specific facility, moving beyond theoretical vulnerability management into defence exercised against the facility's own simulated model. The exercise is a simulation, not a live-fire test on the plant, and its result is only as good as the model's fidelity to the equipment it stands for.

4. Psychometric Threat Profiling and the 90-Day Predictive Horizon#

Moving beyond mere sentiment and vulnerability matching, the most advanced predictive capability of this ecosystem lies in the psychometric profiling of the threat actors themselves. Understanding the psychological traits, behavioral patterns, and motivations of adversaries allows for a shift from reactive defense to proactive anticipation. Cybercriminals and state-sponsored hackers leave behavioral footprints in their target selection, coding styles, negotiation tactics, and communications on the dark web.

The system continuously monitors the dark web; the primary venue where cybercriminals plan attacks, trade exploits, and sell compromised credentials. Research indicates that an organization's exposure on dark web forums is highly correlated with forthcoming cyber incidents. By applying Natural Language Processing (NLP) and sentiment analysis to hacker forum communications, the system can extract predictive signals regarding the collective malicious intent of these communities, often forecasting cyber events weeks or months before they breach a target's defenses.

Drawing upon psychological models such as the OCEAN model (the "Big Five" personality traits: Openness, Conscientiousness, Extroversion, Agreeableness, and Neuroticism), researchers and machine learning algorithms can analyze the psycholinguistic features of threat actor communications to build detailed behavioral profiles. The application of these profiles creates a leading indicator of how a threat actor will behave, what assets they will target, and how they will respond to defensive countermeasures.

By unifying this outside-in psychological intelligence with the inside-out telemetry of the digital twin, the platform generates a probabilistic forecast. It evaluates the capabilities and psychological drivers of active threat groups against the specific vulnerabilities, SBOM data, and network configurations present in the customer's facility. If a highly motivated threat group known to target the manufacturing sector with methodical, high-conscientiousness tactics is observed trading exploits for a specific HMI vulnerability, and the digital twin confirms that vulnerability exists within the facility's unpatched asset inventory, the system calculates an elevated probability of attack.

This predictive engine assesses the confluence of vulnerability, actor capability, and psychometric motivation to forecast whether the facility could be targeted within a specific near-term horizon, such as the next 90 days. This predictive window provides an invaluable window of time for security teams to act before a network is breached, allowing them to fortify specific assets, adjust minimum operating requirements, or engage active risk management protocols. This fusion of psychometrics, dark web intelligence, and deterministic physical modeling provides a predictive accuracy previously unattainable in the cybersecurity domain, representing a monumental leap forward for proactive risk mitigation.

5. Flattening the Curve#

Fat-Tail Risk and the Cyber Resilience Credit Score

The culmination of this massive data synthesis; merging physical models, telemetry, safety engineering, macroeconomic surveillance, and predictive threat psychometrics; is the generation of a dynamic cyber resilience "Credit Rating". Much like a financial credit score evaluates the likelihood of default based on behavioral history and market conditions, this cyber rating quantifies an organization's susceptibility to a catastrophic breach. However, unlike traditional, static cyber risk scores that rely on simple vulnerability tallies or outside-in scanning alone, this rating is built upon the mathematical realities of systemic risk, specifically addressing the phenomenon of "fat tails" as extensively studied by risk theorist Nassim Nicholas Taleb.

!Pasted image 20260504124353.png Traditional actuarial models in the property and casualty insurance sector often rely on standard normal distributions (Gaussian curves) to price risk. In a normal distribution, extreme outlier events are considered so statistically improbable that they are essentially ignored in everyday pricing. However, cyber risk is fundamentally non-linear, multiplicative, and deeply interconnected. A single vulnerability in a widely used software library (a risk highlighted by the necessity of SBOMs) or a compromised cloud service provider can trigger a cascading failure across thousands of seemingly unrelated organizations simultaneously. Consequently, cyber loss distributions exhibit extreme skewness and kurtosis; a "fat tail"; meaning that the probability of a massive, market-wiping catastrophe is vastly higher than traditional models predict.

Relying on naive empiricism or point estimates in fat-tailed domains is, as Taleb notes, a violation of both common sense and probability theory. Forecasting single variables without accounting for the complex, compounding nature of the network leads to severe underpricing of tail risk, leaving insurers dangerously exposed when a systemic event occurs. The cyber digital twin directly addresses this epistemic deficit. By continuously mapping the intricate relationships, dependencies, and cascading failure paths within an industrial environment, the twin illuminates the hidden correlations that generate fat tails. It moves the analysis from the realm of broad statistical assumptions to deterministic, probabilistic outcomes based on actual, observable physical and digital reality.

The resulting cyber resilience score is therefore not a static grade, but a dynamic reflection of how well an organization has mitigated its exposure to these catastrophic outcomes. It assigns both the customer facility an overall resilience rating and generates comparative scores for the capabilities of the threat actors targeting them. Organizations that use the digital twin to actively prune their attack surface, maintain high fidelity in their SBOMs, strictly enforce Minimum Operating Requirements, and structurally separate their IT and OT networks effectively "flatten" the tail of their risk distribution. This continuous, mathematically rigorous assessment creates a reliable, probabilistic metric that both risk managers and insurance underwriters can trust, paving the way for a fundamental restructuring of the commercial cyber insurance market.

6. The Telematics Paradigm#

Usage-Based Cyber Insurance for Critical Infrastructure

For the insurance industry to profitably underwrite the immense risks associated with OT and critical infrastructure, the market must transition from a static policy lifecycle to a model of continuous underwriting. The cyber digital twin is the technological enabler for this shift, acting as the industrial equivalent of an automotive telematics device or a "car monitor" used by commercial auto insurers.

In commercial vehicle and fleet insurance, telematics devices track speed, braking, acceleration, cornering behavior, and location in real-time. This "usage-based insurance" (UBI) model allows carriers to discard broad demographic assumptions in favor of precise behavioral data. It establishes a continuous feedback loop where premiums reflect genuine risk, rewarding safe drivers with lower costs and penalizing reckless behavior. In addition, the data generated facilitates a proactive relationship between the insurer and the insured; real-time alerts regarding required maintenance or high-risk operational environments reduce equipment breakdowns and the overall likelihood of a claim.

The application of this paradigm to critical infrastructure via the cyber digital twin is profoundly transformative. Currently, obtaining cyber coverage for heavy industry is a fraught process. Insurers, fearful of the systemic risks and armed with inadequate data, are driving up premiums, imposing strict sub-limits, demanding exhaustive asset inventories, or outright denying coverage for legacy OT environments. The digital twin disrupts this dynamic by establishing a continuous telemetry bridge between the facility's real-time risk state and the insurer's underwriting engine.

Through continuous monitoring of the active telemetry ingested from Splunk, Dragos, and AD, the insurer gains unprecedented visibility into the policyholder's adherence to required security controls. If a facility maintains its physics-based safety baselines, swiftly patches vulnerabilities identified within its SBOM, and responds dynamically to the psychometric threat indicators highlighted by the 90-day predictive models, the digital twin reflects a highly resilient state. In a usage-based or dynamic premium model, this demonstrated cyber hygiene translates directly into financial incentives, such as premium discounts, stabilized deductibles, or expanded coverage limits.

Conversely, if the digital twin detects that an organization has drifted from its secure baseline; perhaps by bypassing safety instrumented systems for maintenance, allowing unauthorized remote access, or ignoring a critical CWE targeted by an active APT group; the insurer is alerted in real-time. This moves the insurer from a passive payer of claims to an active participant in risk mitigation. The insurer can trigger early interventions, convey actionable threat intelligence, and require remediation to maintain coverage validity.

Moreover, this continuous, verifiable stream of security data aligns with emerging legislative and regulatory concepts of "Safe Harbors." As governments seek to incentivize robust cybersecurity practices without stifling innovation, frameworks are being proposed that shield organizations from severe liability, regulatory fines, or false claims act penalties if they can demonstrate adherence to recognized best practices, such as the NIST Cybersecurity Framework. The cyber digital twin, with its immutable logs, detailed SBOM tracking, and continuous simulation data, provides the ultimate evidentiary record required to claim safe harbor protections. By legally shielding the organization, the digital twin further reduces the financial severity of a breach and lowers the total liability for both the insured and the underwriter.

7. Strategic Alignment#

Articulating Value to Global Underwriters

For a technology platform of this magnitude to achieve commercial success, it cannot merely be marketed as an advanced cybersecurity tool; it must be fundamentally integrated into the strategic frameworks of the world's leading insurance brokerages and risk capital providers. To approach an organization like Aon or Munich Re, the value proposition must be articulated in their native language; focusing on capital efficiency, risk transfer mechanics, and the optimization of the corporate balance sheet.

Aligning with Aon's "Total Cost of Risk" (TCOR) and Analytical Frameworks#

Aon's advisory philosophy centers heavily on evaluating the "Total Cost of Risk" (TCOR) for its clients. TCOR is a holistic metric that encompasses not just the cost of insurance premiums, but also the cost of retained losses (deductibles), risk mitigation investments, and the administrative costs of managing risk. The cyber digital twin acts as a powerful lever to optimize TCOR. By providing simulation-backed evidence of reduced exposure, the twin allows Aon's brokers to negotiate more favorable premium rates and terms from capital markets. Simulation-backed is the accurate description; the evidence is a modeled reduction against a stated baseline, and a broker who presents it as a measured loss history will be caught on the first question. In addition, the proactive detection and predictive intelligence capabilities reduce the frequency and severity of retained losses.

By quantifying the exact financial impact of a simulated attack on business operations, the digital twin feeds directly into Aon's proprietary platforms, such as the Cyber Risk Analyzer and Cyber Impact Analysis tools. These tools use financial quantification to address critical operations compromised by severe threats, enabling data-driven decisions on optimal risk retention versus risk transfer strategies. Additionally, the twin can automate the data collection required for Aon's Cyber Quotient (CyQu) Evaluation, bridging the gap between a CISO's technical metrics and a Chief Risk Officer's financial imperatives.

8. Operationalizing the "Find, Flatten, Finance" Strategy#

Within Aon's specialized OT risk consulting divisions, a guiding methodology is the "Find, Flatten, Finance" strategy. The cyber digital twin aligns perfectly with this tripartite framework, automating the technical heavy lifting required to execute the strategy:

• Find: The twin uses its device mapping, SBOM ingestion, and telemetry integration to identify the governance gaps, architectural flaws, and network vulnerabilities driving severity. It executes the Cyber Operational Risk Assessment (CORA-OT) and Cyber Risk Review (CRR-OT) diagnostics automatically and continuously, identifying insurance-sensitive control gaps.
• Flatten: Through simulated attack modeling and integration with safety engineering (CyHAZOP), the twin clarifies the operational exposure and dictates the remediation steps required to reduce; or "flatten"; the financial and physical impact of an event, ultimately driving down business interruption limits.
• Finance: Armed with a dynamic cyber resilience credit score and an irrefutable, continuous audit trail of strong cyber hygiene, Aon brokers possess a highly defensible underwriting narrative. This continuous, timestamped record of maturity instills stronger insurer confidence, unlocking capacity in a constrained market and facilitating superior placement outcomes. Its strength is that an underwriter can audit the log itself rather than accept a summary of it.

This technology is exceptionally well-suited for Aon's expanding capabilities, such as their Data Center Lifecycle Insurance Program (DCLP), which addresses technology errors and omissions across interconnected infrastructure. In addition, it complements Aon's initiatives like the Cyber Innovation Forum, acting as a catalyst for cyber resilience, and aligns with the deep engineering focus brought on by acquisitions in the Global Risk Consultants (GRC) space, merging physical property risk engineering with advanced digital modeling.

9. Reinsurance and Market Innovation: Munich Re and Systemic Capacity#

Reinsurers like Munich Re bear the ultimate burden of systemic, fat-tail catastrophes. Consequently, their appetite for cyber risk is heavily dependent on the ability to quantify and control accumulation risk. Munich Re champions an "Active Risk Management" approach, using vast amounts of data, geospatial analysis, and continuous insights to proactively safeguard investments and strengthen resilience. They have demonstrated this through platforms like Location Risk Intelligence, which integrates satellite data from providers like ICEYE to assess flood and natural catastrophe hazards. The cyber digital twin functions as the equivalent active risk management engine for industrial cyber portfolios.

By providing reinsurers with aggregated, anonymized telemetry and probabilistic hazard models across their entire book of business, the twin helps clarify systemic accumulation vectors. If a zero-day vulnerability is discovered in a ubiquitous industrial controller, the reinsurer can immediately query the digital twin ecosystem to identify exact portfolio exposure via the aggregated SBOM data, allowing them to adjust capital reserves instantly or deploy emergency mitigation mandates. This capability could also be tied into financial instruments like Munich Re's Completion Bonds, ensuring that new industrial facilities maintain their required digital risk posture throughout their construction and operational lifecycle.

In addition, as the market explores more efficient capital structures, such as combining cyber tail risk with uncorrelated property catastrophe exposures in shared-limit reinsurance structures, the deterministic data provided by the digital twin is crucial. Lowering capital requirements and bringing alternative capital; such as Insurance-Linked Securities (ILS) or cyber catastrophe bonds; into the cyber market requires overcoming deep-seated model uncertainty and proving to investors that the risks are not endlessly correlated. The deep, physical integration of the cyber digital twin supplies what capital market investors need to see: a measured telemetry record on one side, and an explicit, inspectable model on the other, with the boundary between the two declared. That combination lets an investor judge whether the systemic risk is actively managed and mathematically bounded. It does not by itself establish that it is.

10. References#

The industry platforms, frameworks, and methodologies examined above are Aon's TCOR, CORA-OT, CyQu, and Munich Re's Location Risk Intelligence and Completion Bonds.