The Problems with Cyber Insurance’s Growth Imbalance
By Thomas Johansmeyer
Risk Management, April 2023
The cyber insurance market looks like it’s growing—rapidly, in fact. For the second year in a row, aggregate worldwide premium has surged higher, a trend that is expected to persist at least through 2023. However, there’s more to the cyber insurance market than the outward appearance of strong growth. In fact, worldwide aggregate premium’s upward trend may even be cause for alarm. Premium is up on a fairly stable base of limit outstanding, a key sign that the market could turn from growth to constriction if a solution isn’t found in the near future.
If the cyber insurance sector hopes to reach such lofty goals as exceeding $30 billion in global premium by 2028, it’s going to need more capital. Whether directly into the insurance sector or via support from reinsurance and retrocession, fresh capital should help insurers achieve greater market penetration, build a broader foundation for ongoing expansion, and chart a course for long-term sustainable profitable growth. The same sources of capital insurers have used since the early days of the market won’t be enough, though. Thankfully, the insurance linked securities (ILS) market seems poised to help, particularly with several promising recent transactions. New sources of capital could bolster the foundation for future cyber re/insurance growth.
Disjointed Growth
The growth of worldwide aggregate cyber insurance premium over the past few years has been stunning. Recent client conversations suggest the global cyber insurance market finished 2022 at around $10 billion (some say more), with forecasts of at least $13 billion for the year ahead. It’s an optimistic forecast, but still seemingly a reasonable one. The pause seen during the worst of the ransomware epidemic appears to have been a brief gap in what has become a steady upward trajectory, although it could become quite difficult to sustain this level of growth. The increase in global cyber insurance premium has relied heavily on price increases, and already, some insureds are evaluating alternatives. As a result, there are already signs that the market could lose some momentum.
The other concern is that the growth in aggregate premium is not connected to a growth in underlying limit outstanding. Essentially, premium is growing but the market is not. Despite the strong premium growth shown, limit outstanding has remained generally flat for the past two years, a concern noted among key PCS clients and sources. PCS Global Cyber estimates global affirmative cyber limit outstanding at approximately $360 billion, although a smaller contingent in the market believes the total is around $500 billion. In both cases, though, the number isn’t growing, suggesting the consensus that limit is stuck at present levels despite premium growth.
The growth of premium without attendant growth in limit could signal more than an upper constraint on the former. It raises concerns that insureds could question the value of the cover relative to price, which in turn might lead to a constriction of both cyber insurance premium and limit in the future. While many factors could contribute to the remediation of this dynamic and keep the cyber insurance market on an overall growth trajectory over the next decade, capital availability has been a fundamental problem.
Reliance on Reinsurance
Historically, insurers have been reluctant to hold large positions in cyber risk, as evidenced by their heavy use of reinsurance. Recent estimates suggest that insurers cede as much as 55% of what they write, and that’s up from a still high 40% in 2020. Although PCS has learned of more recent forays into event covers and excess of loss structures, quota shares remain the norm, suggesting that any change in insurer buying behavior will take time to manifest. For now, this means that the easiest way to bring in more underwriting capacity is to find more reinsurers willing to allocate to cyber.
The cyber reinsurance market’s growth patterns have essentially mirrored those of the insurance market, largely because of the use of quota shares. Aggregate premium is up on fairly stable limit. Some new players have cautiously entered the market over the past two or three years and slowly grown their allocations to the class of business, but small moves offer little near-term relief. The cyber reinsurance market is highly concentrated, with the four largest responsible for roughly two-thirds of affirmative cyber reinsurance premium, according to PCS internal research. Absent a major shift in how reinsurers manage risk and capital for cyber, they’ll need access to more risk transfer alternatives. And while the retrocession market has shown some signs of maturity, concerns remain that it is a bit thin, uneven, and unreliable.
The recent entry of some additional capital into the retrocession market represents a welcome development. In addition to the recent Hannover Re/Stone Ridge transaction, there have been some additional allocations to the retrocession market—including from relatively new entrants to the cyber reinsurance market. The question remains, though, as to whether the recent rise in retrocession will enable more market growth by freeing up additional underwriting capacity or if the recent trades simply provide capital relief to reinsurers seeking to derisk. The latter, of course, would mean that additional allocations are unlikely to result in market expansion—and could even be seen as an effort to curtail previous commitments. The uptick in the retrocession market, at a minimum, provides a proof of concept for the flow of additional capital later, which should facilitate market expansion. The mechanics have been worked out, shrinking the distance between the decision to deploy and the effect of having done so. For new sources of capital, the reduction of friction could become particularly relevant.
Cyber ILS
Calls for greater ILS involvement in the cyber re/insurance market are hardly new. In fact, PCS entered the cyber sector as a loss reporting organization in 2017 in direct response to the earliest signs of this demand. However, the cyber re/insurance market has been fairly slow to attract cyber capital. The small cyber catastrophe bond completed in the first quarter of 2023 may provide some cause for optimism, but like the retrocession deal discussed above, it’s major contribution is the removal friction for future trades rather than the near-term flow of capital. That said, there are signs of increasing ILS interest in cyber re/insurance.
Research conducted by PCS in early 2022 shows that seven ILS fund managers have traded cyber risk, a number that may have increased since then. At least six more have expressed interest in the class of business, and although none has a specific timeframe for market entry, several respondents expressed eagerness. Barriers to participation range from structuring to analytics to rising rates in other classes (e.g., property-catastrophe after Hurricane Ian), but the two first-quarter 2023 transactions suggest that such impediments can be managed. Further, clients indicate an increase in the diversity of deal flow from cyber re/insurers to the ILS market, to include industry loss warranty (ILW) transactions.
The ILS market could become a strategic source of risk transfer capacity for cyber re/insurance—as it has for the property-catastrophe reinsurance market. And indeed, that process already seems to be moving forward. Of course, the continued flow of capital—and ability to scale it—will depend on a range of factors, from the cyber threat and loss environment to the ability to improve analytical capabilities and deliver the structures that ILS funds will find appealing. Continued innovation and flexibility are likely to reward the cyber re/insurance market not just with further growth, but with the sustainable profitable growth characteristic of a healthy and vibrant market.
The views expressed herein are those of the author, based on research conducted by the author. Statements of fact and opinions expressed herein are those of the individual author and are not necessarily those of the Society of Actuaries, the newsletter editors, or the respective author’s employer(s).
The author, Tom Johansmeyer, is head of PCS, a Verisk business. PCS, a Verisk business, generally provides data and analytics to the global re/insurance and ILS markets. PCS captures reported loss information on certain events, which encompasses, on average, approximately 70% of the market. Any reference to industry-wide is based on this research and the author’s view of trends in the industry, and does not necessarily represent the view(s) of others in the industry. The author can be contacted at +1 441 799 0009, tjohansmeyer@verisk.com, and via LinkedIn.