Emerging perils can provide exciting opportunities for insurance firms to pursue organic growth. The prospect of deploying capital into a new product like cyber insurance, and potentially becoming a market leader in that space, is something nearly all insurers strive towards. Cyber is by far one of the hottest new perils to grasp the attention of insurance markets worldwide. Market capacity has grown considerably in the past decade, spurred on by developing social and regulatory frameworks around privacy and personal data protection, as well as a sharp uptick in malicious cyberattacks.
Cyber insurance was born as a business interruption coverage for non-malicious cyber-triggered loss events. Since then, the product has evolved to protect firms against privacy breaches, malicious cyberattacks, systems failure coverage, contingent business interruption and contingent business failure. As a net new peril, some of those coverage aspects are still very difficult to underwrite, particularly when assessing contingent risks, according to Josh Ladeau, global head of tech E&O and cyber at Aspen Insurance.
“We’ve reached a situation where the cyber insurance market has so much capacity and there’s so much focus on cyber as an area for growth in insurance, that the market’s almost moving a bit faster than we can genuinely underwrite to,” Ladeau told Insurance Business. “If we look at contingent business interruption risk, for example, the quality of a given risk is reflective of its scrutiny of the third-parties it does business with.
“Typically, a cybersecurity-driven organisation will tend to choose third-party vendors that also demonstrate good levels of cybersecurity and resilience. Underwriters have some capability to write around that, but contingent risk remains an exponential threat which is difficult for underwriters to wrap their arms around. Furthermore, the limits and the nature of that contingent coverage has changed in the past year. Whereas a year ago, underwriters could get away with naming vendors they would consider for third-party business interruption risk, now they’re under pressure to offer blanket coverage at full limits for all of the vendors in a particular insured’s third-party relationship tree.”
The ardent market enthusiasm for an emerging peril is not a new phenomenon, but if capacity grows out of control, that’s when cracks can start to appear. Ladeau pointed out that capacity in the cyber insurance marketplace is currently outpacing appetite for the risk – a dynamic which has created a depression on pricing and rates.
“It’s very interesting to watch what happens as losses develop in the cyber space,” Ladeau commented. “So far, a loss for a given risk has typically only had a temporary and narrow impact on that industry class. For example, a large loss like the Marriot breach, might cause a small shift in pricing around hospitality as an industry segment, but only for a short amount of time. The industry currently has a short memory around some of these losses.
“Even massive losses, like a potential limit loss on a $350 million tower, aren’t necessarily slowing the risk selection appetite of most cyber markets. You might see a few players backing away, but there are always markets ready to take their place. Over the years, we’ve seen a depression in rates, and we haven’t seen what I would describe as an appropriate response to large cyber losses. In a worsening threat landscape, that’s dangerous in terms of what implications it has for the market.”
Some of the most significant cyber losses to date occurred in 2017. The NotPetya and WannaCry attacks shook the entire world, causing large aggregated losses with wide-reaching implications. In the same year, US credit agency Equifax suffered a data breach that affected 143 million consumers and JPMorgan suffered one of the biggest bank breaches in history. As the industry experiences more aggregated cyberattacks, the portfolio strength of insurers will likely be tested and the pack might thin out, according to Ladeau.
“Lots of markets have entered the cyber space and are playing it in the same way they would any other professional services product. With something like lawyers’ professional liability, offering $10 million in excess of $100 million for relatively thin rate is often considered a safe way to build a portfolio. We’re seeing markets take similar capacity plays for cyber insurance, but in reality, the cybersecurity landscape is completely different. There’s a different trajectory for typical loss in cyber,” Ladeau commented.
“I think that’s being learned by the market, but again, the amount of capacity available is almost overshadowing that for now. What I think you’ll see in the future is a greater frequency of these mass-level attacks, more acknowledgement of that threat by insurance companies, and greater understanding that cyber events are more often tower-implicating losses rather than small-level losses on accounts. That will thin out the crowd in terms of the amount of high-excess capacity players there are in the market, which I think will start to drive a change in pricing as well as hopefully some constriction around coverage grants.”
