Reinsurers must up cyber modelling game

The reinsurance market faces a massive opportunity to grow the cyber market by teaming up with governments and the insurance-linked securities (ILS) market, in a similar manner to the property catastrophe reinsurance market in recent times. But to realise this potential, reinsurers must improve quantitative modelling and data quality to dodge the “iceberg threat” of silent cyber, according to a new report from credit ratings agency Standard & Poor’s (S&P). Frankfurt-based credit analyst Johannes Bender says there are a number of significant obstacles that need to be overcome before the market can truly come of age. These include a lack of global cyber standards that would incorporate a homogenous definition of events, liberal exclusions and relatively low sums at risk offered by (re)insurers. Reinsurers are naturally worried about the potentially vast range of cyber losses that they may incur through traditional coverages – so-called silent cyber or non-affirmative cover. But the potential for this market is clearly huge. As S&P points out, insured cyber losses remain a fraction of total economic cyber losses caused by cybercrime, with about $6bn of insured losses in total (affirmative and non-affirmative cyber losses), versus $600bn of economic losses in 2018. At the same time, however, global affirmative cyber premiums remain low at only about $5bn in 2018. Mr Bender says this indicates a large protection gap. The analyst points out that global economic losses from natural catastrophes in 2018 were about $155bn and insured losses were about $76bn, according to Swiss Re. According to S&P, reinsurers are well placed to help bridge this protection gap but only if they improve data quality and modelling and potentially team up with governments and the capital markets, as with natural catastrophe lines. For now, the reinsurers are understandably cautious given the potential for accumulation risk from non-affirmative cover. Affirmative cyber remains a niche specialty because of the expert skills needed to properly analyse the risk. S&P points out that Munich Re reported affirmative global cyber (re)insurance premiums of $473m in 2018, less than 1% of the group's total gross written premiums of $49.1bn that year. “Given the uncertainties about cyber risks, we believe this cautious approach is appropriate and a reflection of sophisticated risk management in the global reinsurance sector,” notes Mr Bender. But the opportunity for significant expansion of this market definitely exists if investment is made in the right places and people, argues the analyst. Corporate risk managers are seemingly just as interested in the crisis management and business continuity services that leading primary insurers now attach to their cyber policies. S&P believes the same applies to the reinsurance market, as smaller regional insurers tend to lack the knowledge and expertise to properly analyse this risk. “In general, we believe reinsurers are well placed to enable further development of the cyber insurance market. In particular, outside of global multiline insurers, which usually have in-house expertise, some midsize and more regionally focused insurers do not have the resources to significantly increase their cyber expertise and are therefore more reliant on external knowhow and reinsurance. In this regard, reinsurers can help to develop products and share underwriting knowhow, including modelling experience, in exchange for a fee or classic reinsurance protection,” Mr Bender argues in the report. “We also expect reinsurers will be able to help customers understand their non-affirmative cyber exposure and offer solutions to help transfer that into affirmative cover. Reinsurers can also play a role in establishing cyber ecosystems by offering holistic cyber solutions through services and relationships with cybersecurity companies, specialised managing general agents, or insurtech companies,” adds the analyst. “This in our view will create attractive long-term partnerships, unlike the more commoditised capacity in the pure natural catastrophe business. The reinsurance sector, in cooperation with insurers, regulators and governments, can also continue to play a vital role in helping to define affirmative cyber products and global standards such as event definitions or more standardised terms and conditions,” continues the report. Such partnerships and greater clarity on definitions and standard forms should also help foster the rise of state-backed pools and attract fresh capacity from the capital markets, argues S&P. “Due to the enormous potential size of economic cyber losses, combined with the limitations on traditional (re)insurance capacity, we believe (re)insurers will partner with governments and the capital markets to increase capacity in the global market,” states the report. “We observed such behaviours in the catastrophe risk market following Hurricane Andrew in 1992, when state funds for catastrophe risks and catastrophe bonds for capital market investors brought more capacity to the sector. The Singaporean government's plans to introduce a commercial cyber pool with (re)insurers and insurance-linked security backing capacity is a recent example,” it continues. ILS investors will, however, not accept cyber risk as a potential investment opportunity until the market enhances its ability to model this risk and has a longer track record. The non-correlation benefit that ILS catastrophe investors enjoy when investing in natural catastrophe ILS is also less clear for cyber risks, points out Mr Bender. Further, the losses from cyber incidents can be physical, similar to losses from fires, which shows another correlation of cyber risk to catastrophes of human origin, points out S&P. While technically, a government backstop programme like the Terrorism Risk Insurance Act in the US can cover cyber risk, a key concern is that attribution will be difficult to determine, adds the report. “The cyber (re)insurance market is largely fluid as demand is increasing, newer entrants are scratching the surface and the risk itself is evolving. Although the market is immature at the moment, there is still value to be found if (re)insurers properly underwrite risk. If reinsurers are able to improve quantitative modelling and data quality, this may allow for more capacity in the fast-growing business of cyber risk,” concludes S&P.

Reinsurers must up cyber modelling game

Want to read this article?

Read Next

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

Keeping workers safe and productive in a warming world

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

Keeping workers safe and productive in a warming world

Want to read this article?

Read Next

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

Keeping workers safe and productive in a warming world

Related Articles