Cyber market sustainability rests on better risk management

Increased cyber resilience and better modelling will be key to the long-term sustainability of cyber insurance, according to market experts. Cyber insurance buyers have faced some of the toughest renewals in the hardening insurance market, with big price hikes, higher deductibles, lower limits and a contraction in market capacity. Some companies have reportedly struggled to secure adequate cover as underwriters have reduced capacity or turned away new and renewing customers. According to Marsh, cyber insurance rates in Europe have doubled during the past two years and are set to rise further in 2022, albeit at a more modest rate. London market specialty broker New Dawn Risk told Commercial Risk Europe that market hardening could last another two years, while “constraints” on insurers meant some cyber business was currently going unwritten and companies are underinsured. “2021 and 2022 could be a continuation of what we saw in 2020 – higher premiums and higher losses,” predicted Fred Eslami, associate director at ratings agency AM Best. “It will be interesting to see if the industry is able to manage these losses efficiently and whether premium increases return this line to profitability,” he added. The hard cyber insurance market was triggered by the rise in ransomware attacks, which caused profits to slide in what was previously a profitable line of business for insurers. The loss ratio for the top 20 US cyber insurers has been hovering anywhere between 34% and 48%, according to Eslami. Among the top 20 cyber writers, 15 companies saw increases in their loss and defence containment cost ratios in 2020, according to analysis from the ratings agency. The overall loss ratio for this group increased from 47.4% in 2019 to 70.2% in 2020. For the top five writers, this was more dramatic, with an increase from 44.6% to 78.3%. “If one were to estimate underwriting expenses for commercial insurers at between 28% and 32%, we’d see that cyber has been profitable, with combined ratios of 62% to 80%,” explained Eslami. “But when you look at 2020 and the loss ratio of 70%, and assuming the same estimated underwriting expense ratio, we note that the combined ratio has crept up to anywhere from 98% to 102%. This indicates that profitability might be eroding, especially if measures such as premium increase and tightening of terms and conditions do not occur,” he said. In 2020 and 2021, the cyber insurance industry saw a repricing of risk on the back of more frequent ransomware attacks and skyrocketing ransom demands, explained Oliver Delvos, global cyber underwriting manager at Zurich Insurance. At the same time, Covid-19 led to an unprecedented workforce migration to home working and changed the enterprise IT environment overnight, he said. “The evolving risk landscape required a recalibration of capacity, coverage and consequently price. This trend is likely to continue in 2022. Market capacity will likely remain limited and premium rates will therefore continue to rise,” said Delvos. Longer term, the availability of cyber cover will in part depend on risk management at insureds, he added. “Much depends on the preparedness of businesses to withstand increasingly complex attacks and their ability to recover quickly from such attacks. In terms of coverage, insurers will place more emphasis on various risk accumulation scenarios, leading to a re-evaluation of the different BI and CBI coverages in the market,” he said. To ensure cyber remains a sustainable line of business, the insurance industry needs to require a certain level of resilience from business, continued Delos. To obtain the “desired level” of insurance cover, businesses must demonstrate they have adequate risk controls in place, he said. “Inadequate or incomplete risk information is often an obstacle to providing adequate coverage solutions,” he added. Every business needs to have a thoroughly planned and implemented cyber resilience strategy, added the insurer. “Adequate cyber risk controls are critical. At Zurich, we tie underwriting to a company’s level of preparedness according to five areas of the NIST framework – identify, protect, detect, respond and recover. Risk transfer at affordable rates can only work if a certain minimum standard applies to all insureds,” said Delvos. “Appropriate levels of deductibles are an effective way to manage increased insurance costs and keep capacity at desired levels in primary layers. When it comes to business interruption, adequate waiting or qualifying periods could be another effective mitigant to be applied,” he said. The recent cyber market correction is a natural stage in its development, according to Rebecca Bole, head of industry engagement at cyber risk modelling firm CyberCube. “Policies are sold, claims are paid and, subsequently, adjustments are made. Many insurance lines of business followed this same iterative process of developing meaningful insurance products that meet carrier risk appetites,” she said. “Cyber risk is one of the defining risks of this generation and demand for cyber risk transfer will only continue to grow. Therefore, the cyber insurance market will continue to develop and create sustainable products,” she said. Cyber is experiencing the same “maturation” as other lines, such as property natural catastrophe, where terms and conditions and limits have evolved and improved that segment, said Eslami. “Although we hear about this company or that one possibly exiting the cyber market, this is only anecdotal and we have not seen any specific cases,” he said. The majority of players in AM Best’s cyber insurer ranking have maintained the same positions for 2019 and 2020, indicating consistent premium generation. “We expect to see a similar trend and pattern for 2022, with an even increase in premiums. Again, we do not believe cyber is something that insurers will exit, but they will instead devise ways to control and limit its impact,” said Eslami. For example, carriers are increasingly applying data and analytics to their risk decision-making, in particular through cyber risk modelling. This year, a number of major brokers and insurers have signed up to cyber risk modelling and exposure management tools and services, including those offered by CyberCube. “As the cyber insurance industry seeks long-term stability and profitability, for the good of policyholders and shareholders alike, there is certainly increased interest in quantifying cyber risk, using data and analytics,” said Bole. “Risk modelling is a tried-and-tested risk management and risk decision-making tool that applies as much to quantifying cyber risk as to other classes of business,” she added.

Cyber market sustainability rests on better risk management

Hardening set in for next year at least

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Related Articles