The global cyber insurance and reinsurance market is projected to sustain its profitability through 2025, according to insights from S&P Global Ratings.
The firm's stable outlook for the sector is anchored on continued underwriting gains achieved in 2023 and 2024, bolstered by substantial rate hikes and tightened policy terms implemented between 2021 and 2022.
However, the evolving threat landscape poses significant challenges. S&P cautioned that stagnant or declining rates combined with rising cyber claims could jeopardize profitability.
It emphasized the importance of proactive measures, including encouraging policyholders to improve cybersecurity, refining policy language, adjusting rates selectively, and managing retention levels and insurance limits cautiously.
S&P projects that global annual premiums for cyber insurance will grow from approximately US$14 billion in 2023 to US$23 billion by 2026, reflecting an annual growth rate of 15-20%. Asia-Pacific and Latin America are expected to see the fastest expansion, given the relatively immature state of their cyber insurance markets compared to the US and Europe.
Despite these regional disparities, cyber insurance remains one of the fastest-growing segments in the global insurance industry.
The firm underscored the need for a sustainable model that balances rising demand with the risks posed by an increasingly dynamic cyber threat environment. The influx of new players, including reinsurers and managing general agents, has heightened competition, particularly in the US market.
This has led to reduced retention rates, lower premiums, and eased sub-limits, potentially pressuring margins and capital reserves.
Artificial intelligence is amplifying the scale and sophistication of cyber threats, S&P noted. Tools powered by AI, such as automated hacking systems and Ransomware-as-a-Service platforms, are enabling cybercriminals to launch highly targeted attacks, including phishing and email extortion, across multiple regions.
The expanding use of AI for malicious purposes could lead to an increase in the frequency and severity of cyber incidents.
S&P stressed that insurers must prioritize understanding AI's implications for claims development, risk modelling, and pricing. The interplay between attackers exploiting vulnerabilities and defenders strengthening protections will shape the loss ratios of cyber insurers in the years ahead.
Insurers’ adoption of AI-based tools to assess and price emerging risks is also expected to play a pivotal role in their operational resilience.
The modelling of systemic cyber risks, including large-scale incidents such as coordinated ransomware attacks, remains a challenge for the industry. S&P highlighted the potential impact of events like the 2024 CrowdStrike outage, which disrupted millions of systems across industries and exposed vulnerabilities in software supply chains.
While the financial repercussions for insurers were contained, the incident underscored the importance of robust risk assessment and contingency planning.
S&P noted that rising claims, fuelled by evolving privacy regulations and more sophisticated ransomware attacks, have increased both the frequency and severity of losses. For example, Allianz reported a 14% increase in large cyber claims during the first half of 2024, with claim sizes growing by 17%.
Reinsurance continues to play a critical role in the cyber insurance market, S&P said, with primary insurers ceding about 56% of premiums to reinsurers in 2023. The reinsurance market has evolved, with a growing focus on event-based structures such as excess-of-loss agreements and aggregate stop-loss arrangements. These developments indicate a maturing market capable of absorbing high-severity losses.
The firm anticipates increased diversification in cyber reinsurance as more carriers enter the market and existing players expand their offerings. Advances in modelling and scenario analysis are expected to enhance risk assessment and support further growth.
Insurers themselves are not immune to cyber threats, S&P warned. The CrowdStrike outage demonstrated the operational risks associated with third-party cybersecurity providers, including data breaches, system outages, and ransomware attacks.
While the insurance industry managed the incident’s impact effectively, it highlighted the sector’s growing vulnerability as digitalization accelerates.
S&P’s analysis suggests that large, well-diversified insurers are generally equipped to withstand operational cyber risks due to strong capital adequacy and robust risk management frameworks.
However, the potential for reputational damage and secondary business disruptions remains a concern.
As the market navigates a soft rate environment, S&P emphasized the importance of underwriting discipline and risk differentiation. Insurers are increasingly adopting data-driven models and quantitative underwriting techniques to better assess risks and respond to changes in the cyber landscape.
While current profit margins are viewed as sustainable, S&P cautioned that stagnant rates or intensified competition could erode these gains.
The firm will closely monitor industry developments, including pricing trends, policy wording, and risk management strategies, as the market works to maintain profitability and build reserves for potential long-tail events.
In conclusion, S&P highlighted that the future of cyber insurance growth will depend heavily on the ability of reinsurers to provide the necessary capital and capacity. As systemic risks and operational challenges evolve, the industry’s focus on advanced modelling, effective pricing, and strategic cycle management will remain critical to its long-term sustainability.
What are your thoughts on this story? Please feel free to share your comments below.
