Cyber insurance: Set to stabilise in year ahead as hard market peaks

Brokers believe the cyber insurance market could stabilise through 2022 and into next year. Things will be helped by more capacity, which is expected to enter the space, albeit slowly and cautiously, including from the reinsurance market.

But for now, while other parts of the commercial insurance market have finally showed signs of moderation, cyber continues hardening with rates more than doubling towards the end of 2021 and the beginning of this year.

The huge rises in cyber rates have seen insureds decrease their limits, increase retentions and consider alternative programme structures, such as captives, to combat the difficult conditions bought about by heavy losses at insurers. But it seems that price increases may have peaked.

Marsh’s latest figures show that while cyber rate increases are still challenging many clients, there is “consistent downward movement” in North America from the record rises seen in December. Rates rose by an eye-watering 133% in December but have steadily fallen each month since to a rise of 90% in April, according to the broker.

Marsh stresses, however, that the lower increases are normally only offered to companies that can demonstrate strong cyber risk controls as underwriters become more selective.

The broker says companies that have not made cybersecurity improvements deemed necessary by underwriters are still facing challenges to secure coverage. If these firms can get cyber insurance, it tends to be “significantly” more expensive and subject to restrictive terms and conditions, it adds.

And Howden reports that while the average costs of cyber cover rose steeply last year, rate increases slowed in April to 105%.

State of transition
Shannan Fort, partner in McGill and Partners’ financial lines team, says the cyber market is still in a “state of transition”. “The rate increases are slowing a bit but they haven’t stopped yet,” she says. “We are starting to see renewals where rating is more predictable, which gives clients a bit of comfort.”

Debbie Hobbs, head of cyber, technology and media at Miller, says the cyber market remains in a hard or corrective phase, with the trends seen through 2021 mostly continuing this year.

She explains that cyber premiums have been increasing by 100% on average and it has not been uncommon to see rate increase of more than 300% for risks with no material change in exposure. This is often coupled with higher retentions and more restricted coverage, adds the broker.

But she expects things to look slightly better from the buyers’ perspective as we get nearer year-end renewals.

“At the end of 2021, we saw insureds facing significantly higher premium increases than those with renewals earlier in the year… but we expect there to be some relief for insureds towards the end of the year for those that already faced increases of 100% or more,” says Hobbs.

“With the ongoing prevalence of ransomware, in addition to the Ukraine crisis, we would expect insurers to remain very cautious and do not foresee a major change in the current market conditions. However, we are starting to see some insurers open up again to new business opportunities, which has come as welcome news after many months of some insurers not considering any new risks. Furthermore, insureds have had to become better risks, which in turn is helping to make risks more attractive and insurable and will, in turn, result in a more stable market,” she adds.

Loss experience
Fort also thinks the market will begin to move in buyers’ favour and is optimistic about how things will look this time next year. But she stresses this will depend on the loss experience of insurers, and how well their risk selection and the work put in by risk managers to meet underwriting standards starts to pay off.

“Ideally it would start to level off towards the end of the year and beginning of next but that will be driven by claims experience. I think the severity of claims has dropped and is improving, but it is a bit less clear how much the frequency is improving,” says Fort.

“The risk selection by the market over the past couple of years should be having a positive impact. Insurers should be seeing a decrease and improvement in both frequency and severity of losses for these efforts to have been successful. They should be seeing a better overall protected client,” she continues.

Howden believes that cyber insurance rates, which rose by more than 120% in the first quarter of 2022 according to its figures, could stabilise for buyers later this year if ransomware activity continues at lower levels.

The broker adds that recent improvements in profitability at cyber carriers could attract new capacity into the market and help buyers.

David Rees, executive director at Howden, says the stage is therefore set for cyber prices to moderate. “Whilst the value of cyber insurance continues to prevail for the vast majority of buyers, pricing is now approaching the limits of economic viability for some. Compounded increases from here are not sustainable, which, assisted by the more favourable claims environment that appears to be manifesting this year, is likely to moderate or even stabilise pricing,” he says.

Howden says risk management demanded by insurers to secure cover and increase cyber resilience is already impacting ransomware frequency. And the brokers note that the war in Ukraine has, at least for now, seen the number of cyberattacks ease off, despite initial fears that ransomware attacks would increase.

Rates stabilising
Marsh too is increasingly optimistic that North American cyber rates will stabilise this year, amid signs that rises are already beginning to taper off.

In its second-quarter update on the US and Canadian cyber market, the broker says things are expected to remain challenging for buyers for the foreseeable future, given ongoing accumulation and systemic risk concerns. But it says there is growing evidence that steep rate increases seen during the past several quarters are moderating as attritional losses are better controlled and premium growth exceeds incurred losses.

“As we look ahead at the rest of 2022, there is reason for cautious optimism that rate increases will stabilise and insurers will reward strong cyber hygiene controls,” says Marsh.

Market conditions are likely to be helped by rising competition and new capacity, it continues.

“As underwriters gain more confidence in pricing cyber coverage following a period of adjustment, there is increased competition and interest from new entrants, increasing the likelihood of rate moderation,” says Marsh.

Capacity issues
The brokers agree that capacity has been harder to come by in the cyber market, with most in-surers taking their line size down to $5m. But Fort says things are moving “modestly” in the right direction here too, with a few more carriers offering $7.5m or even larger lines.

“So it is trending positively but we are not yet out the woods and it is still very challenging,” she says.

Fort adds that many buyers now need to access the global market to get the cover they want.

Hobbs tells a similar story. “Capacity in the cyber market has been reduced, with insurers taking a more conservative approach… building large insurance programmes has become a more difficult and time-consuming process,” she says.

“However, we have started to see a slight shift with increased capacity being deployed and more competitive rates, as carriers look to hit budget and the US domestic markets start to step back in to providing terms at lower attachment points,” adds the broker.

“We have also seen the introduction of a small handful of new entrants to the market, which will bring some additional capacity to London on an excess basis,” she continues.

Fort says some risk managers have failed to get the full cyber cover they wanted, particularly for ransomware.

“There are times when markets are imposing restrictions or sublimiting cover so buyers aren’t able to achieve the limit they want for specific elements of cover. That is definitely still happening. A lot of the difficult area is ransomware, not just extortion but general cover around this risk,” she says.

But generally there has been enough limit in the market for most buyers, Fort continues. What has stopped most risk managers from getting the limit they desire is the cost of cover, she explains.

Hobbs says it is important to strike the right balance between limits and coverage. “More restricted coverage is helping carriers get comfort with providing capacity and in deploying larger lines, thus helping build larger towers,” she says.

Terms and conditions under pressure
The broker also explains that cyber underwriters are only quoting for risks within their core appetite and have stripped out those that no longer fit within their strategy. This has seen cyber terms and conditions come under pressure.

“Contingent business interruption is being stripped out of policies and the trigger for coverage often being restricted to security failure only. The imposing of ransomware restrictions continues, but the major change has been the tightening of war exclusions. This, of course, was on the cards with the introduction of the LMA clauses, but has no doubt been exacerbated given the Ukraine-Russia crisis. We have also recently seen the imposition of specific exclusions for Russia,” says Hobbs.

Fort agrees that terms and conditions have been curtailed but says cover remains in important areas. “There is still a market for cyber physical damage within the cyber market. There is still a market for cyber as a peril-type product within the cyber market. So, while there are variations in terms and conditions, not everything is restrictive,” she says.

Meanwhile, captives have become an increasingly attractive option for cyber risk, especially for healthcare, financial services, retail and manufacturing firms, says Marsh.

“The number of captives writing cyber more than doubled at Marsh in the past five years, as clients continue to look at different ways to utilise them to best fits their needs. Some are using captives for retention purposes when buying larger limits, while others are using it to offset a significant rate increase or fill missing capacity in a programme,” the broker says.