AMRAE study finds French cyber market showing signs of improvement but capacity shortfall persists

The cyber insurance market showed signs of improvement for French buyers last year, but they still had to deal with significantly higher deductibles and insufficient capacity to meet the needs of large firms, finds a new study by AMRAE.

A study released in Paris by France’s risk management association found that cyber insurance price increases have slowed down, while loss ratios dropped considerably among the largest insurance buyers.

The study concluded that both frequency and severity of cyber insurance claims tumbled in France last year, which bodes well for the future of the market.

“It is an interesting development because the decrease of frequency can be attributed to higher deductibles, but lower severity shows that prevention measures implemented by companies are having an impact,” said Philippe Cotelle, a member of AMRAE’s board and the risk manager at Airbus Defence & Space, as the study was released.

AMRAE drafted the report after consultation with about a dozen brokers active in the French cyber market. It is the third edition of the study, which is titled LUCY, an acronym for Lumière sur la Cyberassurance (A Light on Cyber Insurance).

The study’s historical data has enabled AMRAE to compare the performance of the French cyber market over the past four years and conclude that, after taking some steps back in 2021 when capacity was tighter and loss ratios were high, things improved quite a bit last year for buyers.

The most conspicuous sign of this improvement was the loss ratio posted by cyber insurers, which dropped in 2022 to 22.3%, compared to 89% in 2021 and 167% in 2020.

The volume of losses fell to €71m in 2022, against €164m and €217m in the previous two years.

On the other hand, the volume of cyber premiums written in France increased by 72% last year, reaching €316m, after closing 2021 at €183m.

AMRAE also noted a spike in the number of companies that bought cyber insurance in France, although this is at least partially due to the fact that the hard market of 2021 had spooked some buyers away from the market.

The number of large corporations with cyber policies went from 240 to 281 last year. The number rose to 591 from 530 among the biggest mid-sized companies. As a result, 94% of the 300 large corporations listed by INSEE, a stats office, now have cyber insurance. The ratio is 10% for large mid-sized French companies.

Large firms could also find higher limits last year, the study finds. But they remain below the amount of cover available in 2019 and 2020. Companies with a turnover of more than €1.5bn were able to purchase an average of €35.23m in cyber capacity, compared to €31.26m in 2021. In 2020, however, the number was €41.03m.

Those with turnover between €50m and €1.5bn saw capacity fall again last year, down to an average €6.02m from $6.55m in 2021 and €8.14m at its peak in 2019.

Cotelle welcomed the recovery of capacity offered to large companies, but stressed that this remains well below what corporations need to transfer their cyber exposures.

Cyber deductibles, meanwhile, continue to rise for French companies when they negotiate their insurance programmes. Among the largest groups, retention levels reached an average of €6.44m, up from €3.99m in 2021. Large mid-sized companies saw deductibles increase from an average of €227,976 to €436,036.

Annual cyber premium rates reached 2.7% of insured amounts for the largest buyers and 1.07% for big mid-sized companies last year. In 2021, the numbers were 2.02% and 0.7% respectively. In 2019, the rates stood at 0.93% and 0.32%. But AMRAE said the pace of price increases has slowed down of late. Large companies paid an average of €950,000 for their cyber policies in 2022.

Perhaps the study’s most positive findings came from the claims side. AMRAE identified an 18% drop in the number of cyber insurance claims among large corporations, and 34% among large mid-sized firms.

The French cyber market’s loss ratio closed the four years to 2022 at 75%, which, in Cotelle’s view, is not enough for the industry to overcome a catastrophic cyber event. But the trend is positive. Among large corporations, the loss ratio dropped from 190% in 2020 to 16% in 2022. For the largest mid-sized firms, the loss ratio was 51% in 2022 compared to 261% the year before.

But AMRAE warned that the cyber market is not out of the doldrums yet. Volatility remains too high, Cotelle said, and some factors could still cause significant increases in loss levels. The study highlights the war between Ukraine and Russia, which has boosted the activity of government-linked hacker groups. The war has also increased the urgency of reviewing war exclusions in cyber contracts, the association pointed out.

Another potential source of cyber headaches for French companies is the rise of artificial intelligence, which could take hackers to new levels, the research warns.

To download the LUCY study, in French, from the AMRAE website, click here.