Cyber Risk Accumulation: Fully tackling the insurability challenge

Cyber perils – malicious or accidental acts that compromise the confidentiality, availability or integrity of data or IT services – have the potential to cause harm to many people and organisations, perhaps simultaneously and across different geographies. For the most part, the resulting damage is small and contained. For example, an isolated data privacy breach is problematic for those impacted but likely has limited broader effects. However, depending on the nature of an incident – especially the number and type of targeted victims and how the breach subsequently affects other entities – cybersecurity failures could give rise to serious and widespread damage and disruption. Critical impacts can include events that completely disrupt organisations’ ability to carry out their operations as well as affect the health and safety of individuals, which ultimately may lead to catastrophic losses for society, both physical and financial.1

This potential for significant aggregate losses is particularly problematic for insurers that assume cyberrelated risks from their customers, either as part of regular property and liability policies or through dedicated cyber cover. Carriers may find that they face multiple claims from different policyholders across various lines of business, leading to major loss accumulations in their underwriting portfolios. Since re/insurers must hold capital to be able to meet unexpected claims, this serious loss potential inevitably constrains their capacity to absorb cyber risks.

Insurers’ worries about potential cyber loss accumulation are not new. However, rising geopolitical tensions over recent years – most obviously, but not exclusively, illustrated by the outbreak of the Russian-Ukraine war in February 2022 – have materially worsened the cyber threat landscape. At the same time, deepening digitalisation of societies is widening the attack/ vulnerability surface and increasing the cyber risk exposures of firms and individuals. If those risks crystallise, severe economic losses and insurance claims could result, not least because large loss accumulations can arise from the intended targets but also from collateral damage to other parties.

Overall, global cyberattacks increased by 38% in 2022 compared to 2021.2 Ransomware, a type of malware that prevents or limits users from accessing their system or exfiltrates valuable data, has become the most significant threat to businesses, in terms of the sophistication of attacks and the damage that they cause.3 The ransomware-as-a-service model has lowered the barrier to entry for would-be ransomware actors while also enabling adversaries to specialise in different stages of an attack.4 Aside from the costs of extortion, victim firms often incur recovery/remediation expenses, legal fees and business interruption costs, as well as harm to their reputation and brand from any associated data breach.

Ransomware has been a major source of cyber insurance claims over recent years and prompted a major reset in underwriting terms and conditions (see Box 1). After a decline in the frequency of attacks during the first half of 2022, in part linked to the Ukraine-Russia conflict as certain criminal gangs diverted their activities towards the war effort, ransomware activity has picked up again. In the first quarter of 2023, the number of cyber claims rose by close to 50% and stands 473% higher than at the beginning of 2019 (Figure 1).5 And more recent data suggests the threat from ransomware remains elevated – in six of the first seven months of 2023, the count of new victims outpaced levels during the comparable period in both 2022 and 2021.6

FIGURE 1: CYBER INCIDENT RATES

Copy link to this section

Based on Aon’s proprietary database of cyber and errors and omissions (E&O) insurance claims 

Source: Aon7

Box 1: Recent developments in the cyber insurance market

Copy link to this section

Affirmative cyber insurance, either in the form of standalone policies (offering only cyber coverage) or as part of package policies (offering coverages for several classes), has expanded rapidly since it first emerged in the mid-to-late 1990s. Though still small relative to the overall commercial property and casualty (P&C) insurance market, global cyber premiums have increased more than ten-fold in the last 10 years alone to reach USD 12–14 billion in 2022.8 The scope of cover has also broadened to include a range of financial losses connected to a cyber incident such as costs for data recovery, IT forensics, non-damage business interruption as well as liabilities for damages incurred by third parties.

For most of its three-decade life, cyber insurance was a highly profitable line. However, in 2020 and 2021, underwriting performance deteriorated significantly on the back of heightened claims activity. According to Munich Re, from the beginning of 2020 until the end of March 2023, ransomware was, by far, the leading cause of cyber insurance losses. While business and professional services accounted for the highest number of overall claims, the costliest impact was on the financial industry.9

Beyond elevated claims, re/insurer appetite for assuming cyber exposures has also been dented by fears about the sheer scale of losses that could arise from a cyber incident, including the potential for a single event or campaign of attacks to spread across sectors and affect multiple insureds simultaneously. This prompted a withdrawal of underwriting capacity, a sharp rise in the cost of protection and stricter contract terms and conditions.

 

FIGURE 2: CYBER INSURANCE MARKET INDICATORS

Copy link to this section

^a Refers to both U.S. standalone and package policies. 2022 estimate based on estimates from Aon
^b Howden Global index (June 2014=100) 

Source: The Geneva Association, based on data from NAIC, Howden and Aon

 

Though capacity pressures lessened through the second half of 2022 and into 2023 as underwriting profitability improved – preliminary data show a sharp fall in U.S. cyber loss ratios in 2022 – cyber insurance pricing remains higher than in earlier periods, reflecting the heightened risk environment and potential for a catastrophic incident (Figure 2). More restrictive coverage terms, including sub-limits, higher retentions, coinsurance and exclusions, have also remained prevalent, underscoring a hard reset in underwriting standards.10

Many insurers have also introduced cyber-specific war exclusions and tighter policy language to rule out coverage for state-sponsored cyberattacks, or at least those that lead to massive damage and financial losses. While the details of individual carriers’ cyber war exclusion clauses vary and no consensus in the market has yet emerged, there are a number of common features. In particular, the new contract terms often:

• Exempt hostile cyberattacks where the perpetrators are acting under the control/direction, or at least on behalf of, a nation state.
• Set out a robust basis by which any state-backed cyberattack will be attributed to one or more nation states, and the required evidential burden of proof.
• Apply only if the attack(s) significantly impairs either the ability of a state to function or its security capabilities.11

Source: The Geneva Association

So far, ransomware incidents have largely amounted to attritional rather than catastrophic losses for insurers. While the size of some ransom payments has been high, leading to an almost doubling in the average extortion payment in 2022 to USD 1.5 million, the majority of attacks involved relatively small ransoms and remediation costs.12 However, some established ransomware gangs have begun to execute mega-scale attacks, exploiting vulnerabilities in widely used corporate software to infect multiple victims.13 To boost their earnings, cybercriminals are targeting larger companies and making ever larger initial extortion demands, which is sustaining the upward trend in ransom payments.14 Some experts also report a shift towards data destruction rather than solely encryption.15 Coupled with the growing role of artificial intelligence in enabling and accelerating cyberattacks and malicious activities, this is increasing the prospects of not only more frequent but also more costly claims.

Moreover, state-sponsored attackers have increasingly been implicated in targeted and coordinated cyber intrusions, not least given the level of sophistication, capabilities and resources needed to launch and maintain such offensives. This includes ransomware gangs as well as hacktivist groups who select their targets based on nationalistic and political motivations, often with the explicit or at least tacit approval of a government. According to threat intelligence from Microsoft, nation-state actors have become more aggressive in cyberspace, even beyond the Russia-Ukraine conflict, including using cyber weapons for both disruptive and destructive purposes.16 In 2022 alone, the number of new wiperware variants (designed to permanently erase files and immobilise computer systems) exceeded the combined number recorded throughout the previous 10 years.17

Against that background, it is perhaps unsurprising that prudent insurance companies underwrite cyber risks with tightly defined contract wordings and limited risk-absorbing capacity. Individual policy limits – both per incident and cumulative over a policy period – on dedicated cyber insurance are low, even for large companies. And certain coverages such as business interruption may be sub-limited to a fraction of the overall total. According to the insurance brokerage firm Woodruff Sawyer, many carriers offer a maximum policy limit of USD 5 million.18 As a result, companies often collate coverage from multiple carriers – to form a risk or loss tower – to reach their desired level of cyber insurance coverage.

Yet as firms, individuals and governments become ever more reliant on digital technology, especially the criticality of network connectivity – which has only been reinforced by the post-pandemic shift to remote working – the overall costs from a major cyber incident or campaign of attacks continue to magnify. Guesstimates of the annual cost of cybercrime range widely from around USD 1 trillion to as much as USD 8 trillion.19 Relative to the global cyber insurance market, which is worth around USD 12–14 billion in premiums, this suggests a sizeable chunk of cyber-related losses are uninsured. Some commentators estimate an overall implied cyber protection gap of perhaps more than 99% of potential losses.20

Even if industry predictions for continued, rapid, near-term growth in cyber insurance premiums are realised, driven by increased take-up rates and/or a further broadening of coverage rather than simply increased premium rates, it is not clear that will make a large dent in the degree of underinsurance. The frequency and severity of cyberattacks seem only likely to grow further. On some forecasts, the annual costs of cybercrime could triple by 2027, dwarfing the projected increase to over USD 33 billion in global cyber insurance premiums over the same period.21

Advances in quantifying potential aggregate cyber losses will be vital in expanding cyber re/insurance capacity and helping to close the protection gap. In particular, improved ways to assess how cyber incidents could create large accumulated claims across their portfolios will help re/insurers better navigate the boundaries of insurability while also developing viable cyber risk solutions for policyholders with broader coverage and larger limits. The rest of the report therefore explores how far the re/insurance industry is getting its arms around possible cyber loss accumulations and the ongoing challenges they pose.

Section 2 provides some analytical context by briefly reviewing the actuarial challenges that cyber poses for conventional risk quantification. This is followed in section 3 by a discussion of the key pathways to loss accumulation. Section 4 describes the latest modelling approaches that re/insurers are developing to understand and quantify their cumulative cyber exposures. Given the residual ambiguities surrounding cyber exposures that will likely persist, section 5 considers what steps, beyond improved modelling, might be taken to progress more optimal sharing of extreme cyber risks across society. The final section offers some concluding remarks.

The traditional actuarial approach to measuring risk is to use information on both the number and magnitude of past losses to infer probability distributions for the frequency and severity of future losses over a particular horizon. Combining these two distributions gives an aggregate loss probability distribution, which provides a forward-looking view of the full range of possible losses that might arise and their associated likelihood over a given period of time (Figure 3).22

FIGURE 3: STYLISED REPRESENTATION OF THE TRADITIONAL ACTUARIAL APPROACH TO RISK QUANTIFICATION

Copy link to this section

^a The exceedance probability (EP) refers to the likelihood that a loss of any given size or greater will occur in a given year. A return period (r) is another way to express the annual EP probability, and describes an estimated likelihood of a loss of a given size occurring within a given time frame (i.e. r = 1/EP)

Source: The Geneva Association, based on Swiss Re and Verisk23

From the estimated aggregate loss distribution, the actuary can construct various metrics about the riskiness of an insurance portfolio. For example, the value-at-risk (VaR) indicates the minimum insured loss that is likely to be met or exceeded in a given year for a given level of probability. VaRs at different assumed percentiles of the loss distribution trace out the so-called exceedance probability loss curve or, equivalently, the likely time period over which a given minimum loss amount might occur on average (i.e. the so-called return period). Armed with such information, an insurer can assess probabilistically the size of cumulative claims across its policies and compare that with its willingness and ability to bear losses that might turn out much larger than expected.

Such loss metrics are the modern-day language in which risk is typically communicated. However, these conventional actuarial methods face significant hurdles when applied to risks such as cyber. In practice, the aggregate loss distribution is often not well-defined nor reliably estimated. Consequently, calibrating risk appetite for cyber exposure is not as simple as reading off from estimated curves the level of aggregate losses that might be exceeded with a particular probability.

For many perils, the factors that drive claims frequency/ severity are well-understood and can be modelled with standard statistical approaches. The novelty of cyber risks and the absence of an established terminology for cyber incidents, however, makes it difficult for insurers to curate a meaningful database about losses. From a statistical perspective, too, actual history is just one realisation of what might have happened. For routinely occurring cyber events, the actual history of losses is often large enough to encompass most realistic possibilities. But for rare and severe risks, relying on historical information may be misleading because it may encourage perception biases about these sorts of tail events.24

Moreover, even with richer and more standardised loss data, it is not clear that the past is a reliable guide to the future. Cyber risks are highly dynamic with new threat actors, attack methods and technologies coming into play, making it extremely difficult for insurers to understand and monitor exposures. This includes changes in laws and regulation that may significantly alter corporate risk management strategies and the losses insured under a policy, thus posing additional risk to insurers.25 The potential for ‘unknown-unknown’ cyber threats creates significant ambiguity around the underlying sources of exposure, especially since these may be different for regular data/IT security breaches compared with business interruption events. A victim may also be compromised for an extended period of time and not even realise it – only for damage to occur suddenly and unexpectedly.

The human element complicates the modelling of cyber risks, through its influence on the scope for accidental and malicious disruption both from insider and external attacks. Hackers’ motivations and methods will respond to the latest security measures and their effectiveness in exploiting vulnerabilities. Low-level attacks are often not isolated events but continuous and widespread, not least because of easy access to malware via Darkweb markets and more generally the whole cybercrime-as-a-service business model. By the same token, the actions taken by firms to detect and counter threats can go a long way to thwart and mitigate the impact of cyber intrusions.

Put another way, cyber is an anthropogenic peril. Losses do not occur in a completely random fashion akin to the outcome of a game against nature in the way that, for example, air and ocean surface temperatures create conditions for weather storms. Instead, the extent of any losses depends on the interplay between the incentives, motives and resources of both victims and attackers. Even a small shift in the balance between the capabilities of hackers and cyber defences could affect the threat landscape and lead to a significant shift in the likelihood and costs of a cyber incident.26 For instance, the success of a cyberattack in exploiting a known software vulnerability will depend not only on the actions of the hacker but also the speed and agility of users in deploying security patches.

Cyber risks are often highly interdependent: one compromised system may infect others both within and across firms, and perhaps across different geographies, although the degree of codependence will vary according to the type of cyber threat (Table 1). A failure of an individual computer due to a hardware problem would probably cause limited damage within the same firm. Similarly, while an insider who abuses his access privileges could affect almost all computers on the internal network and cause significant disruption within a company, the potential for compromising other firms’ systems is limited. In contrast, attacks involving user interaction such as phishing or spyware/ malware can lead to correlated vulnerabilities across firms if employees in many different firms are targeted. Other types of malware such as worms and viruses can self-propagate across IT networks, leading to correlated damage both within and across firms.27

Aggregate loss models must take adequate account of the different dependence structure in arriving at meaningful representations and quantification of cyber risks. This can be challenging, especially allowing for complex, non-linear relationships among multiple risk factors. The types of losses that can occur from a cyber incident and how they interact are also difficult to assess. They often involve intangible assets and liabilities such as data/privacy breaches, intellectual property infringements and reputational harm, the financial costs of which are hard to measure.

Cyber perils may give rise to losses that extend well beyond the financial costs of network interruptions or data/privacy – the mainstay of dedicated cyber insurance – including physical property damage and bodily injury. A cyber event might therefore lead to multiple claims, perhaps under different insurance policies, including those for which coverage was never intended and therefore priced for (so-called non-affirmative or ‘silent’ cyber). Many traditional property and liability policies are written on an ‘all-risks’ basis and may not specifically refer to cyber-related perils.

Silent cyber exposure is a key reason why re/insurers have made determined efforts over recent years to tighten contract language either to expressly include or exclude coverage for cyber risks in commercial property and liability policies. Some exclusions, however, may still be loosely drafted and may not be entirely consistent across policies, creating scope for coverage disputes. For instance, some clauses refer to ‘cyber events’ while others refer to the use of ‘software’ or are limited only to ‘malicious’ cyber incidents. The way the terms are defined in individual contracts complicates the task of assessing potential cyber-related underwriting losses – affirmative or non-affirmative – coming from different insurance classes that may be triggered at the same time and could give rise to significant aggregate losses.

TABLE 1: EXAMPLES OF DIFFERENT KINDS OF CYBER RISK CORRELATION

Source: The Geneva Association, based on Böhme and Kataria28

Compared with other commercial insurance such as general or product liability, most standalone cyber insurance policies are written either on a claims-made (for third-party liability) or on a discovery basis (for first-party losses) rather than on an occurrence basis. That is, coverage responds only for claims notified or damage discovered during the current policy period, regardless of when an attack first occurred. This reduces the scope for inadequate reserving, not least because it overcomes the potential for policyholders to combine or ‘stack’ limits in the event of an occurrence that spans multiple policy years.

Nonetheless, insurance actuaries must still estimate the extent of incurred-but-not-reported losses as well as adverse development on claims that are reported, which can be difficult for incidents that reveal themselves only slowly and/or hit multiple policyholders simultaneously. Further, the possibility that claims are disputed and involve protracted litigation can significantly lengthen the tail of exposures. For example, claims payments from the 2013 data breach at retailer Target that impacted approximately 40 million customers were still being made in 2019.29 Company executives may also have to defend follow-on liability claims if they made a decision or took a course of action that breached their fiduciary duties – for example, failing to put adequate cybersecurity measures in place – which might trigger Directors and Officers (D&O) insurance.30

In order to evaluate the potential for cyber losses to accumulate, re/insurers need to understand the ways in which multiple policyholders can be negatively impacted by a cyber incident and the resulting harm that might ensue, as well as which insurance policies could be affected. While hostile cyberattacks are often the most significant source of shocks, accidental (i.e. non-malicious) incidents, including system failures, human errors or programming flaws, can also trigger widespread, correlated damages.

Disruption to critical infrastructure – the body of systems, networks and assets required to ensure the security of a nation, its economy, and the public’s health and/or safety – is a key avenue through which losses from a cyber accident or intrusion could escalate. Such entities are increasingly connected both within and to other networks, meaning that a single point of failure could trigger widespread interruption, especially since malicious parties only need to infiltrate one connection to cause potentially massive damage (Figure 4). The shift to remote working and the use of internet-enabled sensors to relay information and perform legitimate maintenance and other actions on industrial control systems (ICS) has increased the attack surface for these companies, leaving them vulnerable to insider threats and opening up ever more opportunities for external hackers to exploit.31

Cybercriminals, including those backed by nation states, are increasingly targeting critical infrastructure.32 The majority of these assaults has been in the form of ransomware, often exploiting weak legacy cybersecurity protocols to encrypt critical computer systems and data across IT networks. However, commentators also highlight a worldwide, sharp pick-up in 2022 in cyberattacks with physical consequences on operational technology (OT) within key ICS.33 This marks an important departure from the previous decade, where reported attacks were largely aimed at espionage. Several near-misses in core utilities like power and water occurred in 2022, where the ramifications could have been much more serious if the circumstances had been slightly different. Most notably, Ukrainian officials reported in April that they had thwarted a Russian cyberattack on Ukraine’s power grid.34

FIGURE 4: CONNECTIVITY ACROSS CRITICAL INFRASTRUCTURE SECTORS

Copy link to this section

Source: Gartner35

As explained in Box 2, not all losses arising from the failure of critical infrastructure can be insured. Standalone cyber insurance typically excludes losses incurred by firms due to the disruption of key utilities or organisations vital to the functioning of the financial sector or the internet. Such policies will usually extend cover for claims resulting from temporary outages to key internet-dependent services such as a cloud service provider (CSP), which are becoming ever more crucial as businesses migrate their core operations to the cloud. Given the potential for a single outage to trigger widespread disruption, however, coverage typically applies only after a minimum downtime and for proven profit shortfalls or loss mitigation expenses. Parametric insurance solutions have therefore emerged – from both incumbent insurers and start-ups – to offer additional, complementary cover against disruption costs arising from internet outages.36

Source: The Geneva Association

To the extent that a cyber incident at a major critical infrastructure provider caused material physical damage and/or operational disruption, this might also prompt substantial claims under traditional P&C policies, at least where such affirmative cover is provided. A ransomware attack on a hospital’s network, for example, may threaten the lives of patients by interrupting critical medical treatments, which could trigger liability claims.39 Recent incidents suggest that even an isolated cyberattack can have ripple effects that impact healthcare delivery across an entire region, significantly increasing the number of victims.40

Catastrophic cyber incidents can arise not only from failure of critical infrastructure. Structural features in the way business activity is organised allow a cybersecurity breach or accident at a single firm to propagate widely. Production supply chains increasingly rely on third-party organisations that deliver not only physical inputs but also digital services. In particular, so-called managed service providers (MSPs) typically provide a portfolio of IT services to business customers including software engineering, data storage, network security and disaster recovery management.41

The adoption of managed services can be an efficient and cost-effective way to stay up to date with rapid technological change, access in-demand skills or expertise, and have flexible, scalable and high-quality IT services. This is especially true for small and medium-sized enterprises (SMEs) who may not have the in-house resources or expertise. However, the firm’s data and files can be compromised via the hacking of a third-party supplier with legitimate access to multiple customers’ systems.42 According to Verizon, 62% of system intrusion incidents recorded in 2021 came through an organisation’s partner.43

Over recent years, third-party software vendors have been a favoured exploit of cyber adversaries. Recent prominent attacks include:

• SolarWinds (December 2020) – Suspected nationstate hackers targeted SolarWinds, a major software company that provides network management tools. By planting malicious code into regular software updates, the attackers were able to gain access to the data and networks of thousands of SolarWind’s customers and partners, including U.S. government agencies.44
• Kayesa (July 2021) – A criminal group exploited a vulnerability in Kayesa’s Virtual System Administrator software used to distribute ransomware to various MSPs and their clients. This resulted in significant disruptions and financial losses for as many as 2,000 businesses across 17 countries.45
• 3CX (March 2023) – An employee of desktop phone developer 3CX inadvertently downloaded malware via the X_Trader app maintained by the financial software firm Trading Technologies, which itself had earlier been hacked. The infected app allowed the hackers to corrupt a 3CX installer application, thereby spreading malware to a broad swath of its customers.46
• MOVEit (May 2023) – A mass hack breached Progress Software’s MOVEit file transfer app, which is used to move sensitive files such as employee addresses or bank accounts. The attack has thus far impacted more than 2,000 organisations, breaching data from over 60 million individuals worldwide.47

Financial losses arising from cyber intrusions at thirdparty providers – for example, lost business income or remediation expenses incurred to deal with the contagion as well as follow-on liability to customers or vendors impacted by an incident – are usually covered in cyber as well as specific non-damage business interruption insurance policies. However, the scope of coverage varies depending on specific restrictions/exclusions and policy limits. This often reflects the challenges insurers face in gaining a comprehensive overview of the supply and service chains and the potential spillover effects from a disruption to a particular entity.

The nature of software and hardware development in modern economies means that bugs or flaws almost inevitably occur and are unwittingly built into distributed products. Such zero-day vulnerabilities – so called because they are unknown to the manufacturer or vendor at the time the software/hardware is released – can exist for months and sometimes years before being detected. During that time, attackers may steal or copy data and/or damage sensitive systems until a programme fix or security patch is implemented. Since many organisations tend to use similar software, security programmes and other IT infrastructure, multiple organisations are often vulnerable to the same successful zero-day attack.

FIGURE 5: SOFTWARE SUPPLY CHAIN ATTACKS

Copy link to this section

Source: Comparitech and Sonatype48

It is not just contaminated proprietary software provided by third-party providers that can trigger widespread cyber-related losses. Firms, including MSPs themselves, tend to rely on open-source software (OSS) in developing their own IT solutions.49 Indeed, a whole software supply chain model has emerged composed of libraries, tools and processes used to develop, build and disseminate software. This empowers developers to make use of their preferred tools and ship functional software quickly, but it also exposes organisations and their customers to vulnerabilities introduced by changes outside of their direct control.50

According to commentators, software supply chain attacks have exploded over the past couple of years as bad actors have targeted OSS ecosystems (Figure 5).51 While OSS may be no more intrinsically error-prone than other computer code, the distributed development model brings new operational risks.52 One study found that in 2022, nearly two thirds (63%) of the source-code repositories contained unpatched vulnerabilities rated high or critical, with 51% of those at least two years old.53 Another investigation uncovered that 95% of all OSS vulnerabilities were not expressly implemented by developers, but indirectly and automatically incorporated through existing software packages.54

Perhaps the most high-profile recent OSS vulnerability relates to the bug, known as Log4Shell, which in late 2021 was found in the open-source logging library Log4j commonly used by apps and services across the internet. If left unfixed, attackers can exploit the bug to break into systems, steal passwords and logins, extract data, and infect networks with malware. Fortunately, many users quickly reacted to news about Log4jShell and downloaded a patched version of the software within a few weeks. Security experts highlight, however, that about 25–30% of the world is still using the vulnerable versions of Log4j – perhaps because they have no idea whether Log4j is part of their software supply chain – and so could yet be exploited by associated malicious attacks.55

The bulk of cyber insurance claims over recent years have been first-party losses such as business interruption and remediation expenses. However, almost any cyber incident can lead to claims for compensation from affected customers, suppliers and other stakeholders whose data may have been compromised. Moreover, the large numbers of people affected by a common data breach opens up the potential for mass privacy claims, the cost of which might fall to insurers not only under dedicated cyber policies but also, where relevant, other thirdparty liability insurance policies.

The frequency and scale of liability claims are likely to be boosted by increased regulatory oversight and stricter cybersecurity governance requirements. Data breach and privacy regulations continue to expand, following the introduction of tough rules in Europe under the General Data Protection Regulation (GDPR) and more stringent regulations in places such as California, Brazil, China and India. This includes in some jurisdictions potential collective consumer actions on an ‘opt-out’ basis – where the action is brought on behalf of every individual falling within a class unless they expressly opt out – which expands the pool of claimants and potentially the size of settlements.56

Jurisprudence is also developing which could catalyse civil litigation for data breach claims, including through class actions. In some jurisdictions, firms could face lawsuits even if plaintiffs suffer no concrete harm but the incident substantially increases the risk of future ID theft or other harm.57 The latest revelations over the use of pixel tracking technology (sometimes called web beacons) on company websites, which resulted in the unauthorised collection and sharing of users’ private and personal information, only underscore the potential third-party cyber liability exposure connected to privacy breaches.58

Alongside ways in which cyber-related insurance losses accumulate, there may be important factors that limit the potential for aggregation. Perhaps most obviously, many firms invest in cybersecurity to protect themselves and prevent any escalation in losses. This may include reducing reliance on any single vendor or at least having back-up procedures in place. According to one survey, for instance, 87% of firms globally adopt a multi-cloud strategy, with more than half making use of multiple public CSPs.59

Insurers can encourage good cyber hygiene among their policyholders via their underwriting practices as well as the terms and conditions of coverage.60 Likewise, governments through their law enforcement and national security agencies deploy diplomatic and technical resources to pursue cybercriminals, disrupt their business models and limit the spread of attacks, through, for example, sharing ransomware encryption keys.

Within the IT sector, too, structural mechanisms can work to mitigate cyber threats and localise any disruptive threats. Major CSPs invest heavily to maintain their reliability and resilience, including segmenting their services to prevent a failure of one element spilling over to another. CSPs – at least the top tier firms who collectively account for a large market share – usually organise their cloud infrastructure into different geographical regions, known as cloud regions, each of which has multiple availability zones (AZs) hosting one or more data centres.61 This physical separation should in principle ensure that a failure or disruption in one AZ does not impact the availability or performance of other AZs in the region, although spillover effects cannot be ruled out entirely.62 Technology vendors also proactively seek to identify and remedy vulnerabilities before they are exploited, including using internet connectivity to distribute protective software code quickly, disable malware and implement security patches.

These disaggregating factors, collectively and individually, can work to reduce the geographical and sectoral footprint of a cyber incident as well as lower the associated interruption costs or damage to assets. Indeed, they were probably influential in limiting the scale of impact of recent major cyber events such as SolarWinds and the Log4j vulnerability.63 Equally, past near misses illustrate that good fortune also often plays a part in the overall loss impact, underlining the empirical challenges in assessing and calibrating the pathways through which catastrophic cyber losses can occur.64

Despite the relative immaturity of cyber as a peril and associated insurance solutions, incremental progress has been made in better understanding and modelling the emerging risk.65 In general, the latest initiatives seek to combine forensic data about threats and vulnerabilities with cyber domain expertise and advanced risk analytic frameworks in order to craft metrics of potential cyber losses. In doing so, they aim to address, although they do not entirely overcome, some of the empirical actuarial challenges outlined above. These risk quantification efforts have been led not only by re/insurers themselves but also by a growing body of ancillary service providers, including cybersecurity and risk modelling vendors, as well as academics.

Early cyber models had to be built almost entirely on expert judgement, conjecture and speculation due to a scarcity of data and an incomplete understanding of the risk.66 Knowledge gaps still persist, especially when the root cause of any loss is hard to establish and/or third-party involvement (i.e. incident response firms, lawyers etc.) in responding to claims can complicate information sharing with insurers. But more and better quality data and insights can now be gathered from a variety of sources that together help build a picture of the cyber risk landscape. This includes information about the different threat actors, their resources, motivations and habits that can throw light not only on the prospects of attacks but also the potential for multiple victims and the severity of incidents.

Three key types of information play an important role in contemporary cyber threat assessment:

• Historical incidents. Although inevitably incomplete and subject to potential bias – not least because firms may have incentives not to reveal they have been breached, perhaps on account of reputational or legal concerns – the anatomy of past cyber incidents can still be useful. Correlating historic data across attacks helps identify patterns, detect intrusions and reduce potential risks.67
• Firmographics. Information about an entity such as its size, industry location and organisational structure may provide pointers as to its possible cybersecurity vulnerabilities and corporate linkages that might widen the footprint of an incident. For example, firmographic data can sometimes inform about the potential spread of a zero-day vulnerability within a particular piece of hardware or software.
• Technographics. These data provide information about the cybersecurity stance and posture of an organisation and come in two main flavours: inside-out and outside-in.
  • Inside-out data document the hardware and software that companies use to operate their business, including their reliance on MSPs. With a company’s consent, data can be collected by an application or device installed on the firm’s network to provide continuous monitoring of its digital infrastructure.
  • Outside-in data refers to information about a company’s externally facing IT infrastructure which can be scanned ‘from the outside’. These data are often gathered by specialised technology firms with the goal to detect, for example, potential openings for attackers such as open Remote Desktop Protocol (RDP) ports, unpatched vulnerabilities and poorly configured web services.68 This may include building ‘honeypots’ to lure hackers and extract information on their strategies and possible weaknesses in cybersecurity.69

Some vendors combine past incident data, firmographics and outside-in technographic data to develop cybersecurity ratings for individual companies. These ratings help re/insurers in screening insureds and in assessing the overall risk profile of their cyber insurance portfolios, including the potential for common vulnerabilities and contagion. Similarly, defensive AI/machine learning algorithms can help spot and alert users to suspicious behaviour and even highlight ways to prevent intrusions from happening in the first place.70

Even with richer data and analytics, re/insurers still need ways to convert those insights into quantifiable indicators that provide a guide to both the scale and likelihood of future cyber losses. Nascent actuarial approaches differ, but often amount to variations and combinations of three main types: extended frequency-severity models, network propagation models and expert-led scenario analysis.

Extended frequency-severity models

Based on actual claims data, actuaries use regression analysis to fit standard statistical distributions for the frequency and severity of cyber incidents based on observable data such as firm size, industrial sector and cybersecurity maturity. Importantly, compared with traditional approaches such models make allowance for more complex dependence structures between the incidents. This includes correlation across sources of loss (e.g. business interruption and data privacy breaches), between affected policyholders (e.g. due to commonly used software, such as Windows or MacOS) and between the severity of damage (e.g. due to commonly used IT security measures).71

A major obstacle with such models stems from having to extrapolate from actual claims the full extent of possible cyber losses. The estimated parameters are not always robust (or at least are subject to considerable uncertainty) and the implied overall loss distributions may not be well defined.72

Network propagation models

Borrowing from the epidemiological literature on the spread of infectious diseases, these models investigate the extent to which cyber ‘infections’ can spread via entities’ physical or social interactions in a network. The typical cyber context is the propagation of malware across IT systems or devices, but contagion may arise from the breaking of supply chains and subsequent escalation in business interruption.

As well as the topology of how firms are linked, network models also rely on processes that capture how contagion occurs.73 The extent of any disruption will depend, for example, on whether a firm that is suddenly hit has adequate measures in place (e.g. up-to-date software patches or the ability to switch suppliers) to stop the disruption spreading further. Some modellers also allow for behavioural shifts by individual actors (both attackers and defenders) that influence the likelihood of attacks or how firms decide to interact.74

A number of studies have demonstrated that networkbased approaches can generate improved estimates for the frequency and dependence of cyber threats compared with standard actuarial approaches.75 However, such models are often computationally challenging to implement and parameterise reliably.

Expert-led scenario analysis

In the absence of historical data about extreme cyber incidents, re/insurers often turn to the knowledge of experts, both within their organisations and outside, to help calibrate their cyber risk models. Specifically, cyber scenarios are posited and expert judgement is used to inform about the probability and impact of particular disturbances. Rather than modelling individual events, sometimes events are grouped together into event families; for example, the failure and/or outage of a CSP regardless of the precise reason for the interruption.

Such expert-led scenario approaches are the mainstay of a small but influential group of specialist cyber modelling firms that have developed over recent years. Leveraging experience in modelling losses for other extreme perils, most notably natural catastrophes such as hurricanes and earthquakes, combined with detailed cybersecurity intelligence, these vendors construct risk metrics for multiple adverse scenarios. Many cyber re/insurers use these vendors’ models to assess exposures within their underwriting portfolios (at least for cyber insurance), sometimes as a complement to their own in-house models (see Box 3).

Box 3: Re/insurers' use of cyber accumulation models

Copy link to this section

As the cyber insurance market has grown and matured, underwriting practices for managing accumulation risks have evolved. Many re/insurers now use formal models to support their assessment of cyber risks and help steer their exposure management. Primary insurers tend to rely more on external vendors than re/insurers, who have their own in-house models (Figure 6). This includes comparing insights from multiple external models, although in practice different model setups make that challenging, while strict licencing arrangements mean it can become prohibitively expensive.

 

FIGURE 6: USE OF CYBER RISK MODELS BY RE/INSURERS (% OF FIRMS)

Copy link to this section

Based on 52 re/insurers who have in-house or licence external models, weighted by cyber insurance premiums

Source: The Geneva Association, based on data from Gallagher Re

 

FIGURE 7: ROLE OF CYBER MODELS IN UNDERWRITING (% OF RESPONDENT RE/INSURERS)

Copy link to this section

Based on a poll of 11 GA member cyber re/insurers, weighted by relative size of cyber insurance premiums

Source: The Geneva Association

 

Despite progress in modelling extreme cyber risks, cyber accumulation issues are not fully integrated within re/insurers’ underwriting procedures and capital management. According to a poll of 11 GA member firms – which account for around 35% of global cyber re/insurance premiums – most re/insurers rely on ad hoc or partial methods to account for aggregate exposures (across insureds, regions, lines of business etc.) in their pricing/costing of cyber risks and allocation of capital (Figure 7). Of the surveyed re/insurers, more than three quarters employ deterministic or partially probabilistic scenarios – whereby expert judgement is applied to benchmark the return period on associated projected losses – in order to calibrate their risk appetite for cyber exposures.

Source: The Geneva Association

Given the bespoke features of vendors’ scenario frameworks and calibrations, it is not straightforward to compare results across models, especially isolating the crucial assumptions underpinning loss estimates. To the extent that a meaningful comparison can be made, one recent analysis, based on a synthetic market-wide portfolio of cyber insurance policies, indicated a 1-in-200 year global industry event loss in the range of USD 15.6–33.4 billion (Table 2).76 Unsurprisingly, the bulk of those projected claims arise from U.S. risks given the size of the U.S. cyber insurance market relative to other regions.

At face value, such peak losses appear well below estimates of the insurance sector’s aggregate cyber exposure limit.77 Though material, they would be also comparable with insured losses from some natural catastrophes and, in fact, much less than recent extreme weather events. For instance, industry estimates put insurance sector losses from Hurricane Ian in 2022 at USD 50–65 billion.78 However, the projected peak losses are highly sensitive to the assumptions and judgement applied, especially about the pathways to aggregation such as the use of common technologies and suppliers as well as variations in scope of insurance coverage. They also do not capture the full extent of claims from non-cyber insurance policies.

TABLE 2: POTENTIAL LOSSES FROM AN INDUSTRY-WIDE CYBER EVENT, FROM DIFFERENT CYBER MODEL VENDORS (USD BILLION)

Source: Guy Carpenter79

Underscoring the sensitivity point, some model vendors highlight that counterfactual analyses of recent cyber events suggest far larger losses are plausible and a major cyberattack could be much more damaging than anything seen to date. If, for example, the threat actors behind the SolarWinds compromise had focused on sabotage rather than espionage, the outcome would have been materially different. Similarly, the 2017 NotPetya attack – the largest cyber insurance loss event recorded so far – could have been much worse if the attackers had exploited a zero-day vulnerability for which no patch was readily available.80

Even if such conjectures can help assess the extra loss severity, attaching a probability to alternative outcomes is difficult. More broadly, as discussed in Box 4, the immaturity of cyber models suggests caution in placing too much faith in risk metrics from any one or even multiple models. We have yet to witness a cyber incident generating extreme insurance losses – NotPetya being the arguable exception and even then, losses largely hit traditional P&C rather than cyber policies.81 It is therefore impossible to validate the accuracy of both in-house and external vendor models.

Box 4: Challenges of validating cyber catastrophe models

Copy link to this section

Experience with other nascent lines of business suggests that credible risk quantification is vital to achieving sustainable growth and cyber insurance is no different. Formal cyber risk models have therefore been developed by both re/insurers and specialist analytics vendors. Such cyber models have often gone through rapid updates, improving and rebuilding to reflect the evolving threat landscape, understanding of the risk as well as the coverages offered by insurers.

Although models are used to inform accumulation risk management and they rarely dictate pricing, some re/insurers are beginning, or at least are considering, to incorporate model outputs into their economic and regulatory capital setting. Unfortunately, most statistical validation tools are ineffective or unsuitable due to the lack of historical catastrophic events to use as test data, unpredictable threat actor behaviour and the oftentimes rapidly changing nature of cyber risks. Evaluation of cyber models, whereby re/insurers assess the suitability of a model by comparing the outputs against their own view of the risk, is somewhat more achievable. But comparison of outputs across external vendors can be frustrated by differing model specifications and the prevalent use of subjective expert judgement.

 

Variations in model methodologies

Unlike modelling natural catastrophes, where empirical frameworks have mostly converged over time, there are large variations in the methods used to quantify cyber risk. Among the main external vendors’ models, the key differences relate to:

• Event simulation. Some cyber model vendors rely on standard statistical methods to describe the frequency of future attacks, while others appeal to causal analyses. The latter seek to replicate each stage of a cyber event from infiltration, defence through to loss, in order to simulate how attacks might unfold.
• Scenario definition. The sequence of events that make up a scenario typically detail the type of attack, how it propagates across companies and its impact. Modelled incidents often include ransomware, service-provider outage or a data breach, although these may not necessarily be distinct events. For instance, a ransomware attack on a service provider may also involve a data breach, so considered scenarios can vary significantly.
• Coverage and loss components. Cyber policies differ widely in terms of coverage. Vendors have to decide the scope of losses they model and the different cost elements included under each coverage, which can differ markedly.82
• Utilisation of technographic data. Most model vendors use technographic data from outside-in scanning exercises to parameterise their models but the approaches vary in sophistication. The more technical methods seek to match technographic data against companies within their portfolio, but potential errors in matching processes mean this does not always translate into improved model reliability.

 

Divergence of model outputs

Estimated cyber losses differ significantly across models. The divergence is most noticeable when looking at the far tail of the loss probability distributions, especially for a cloud outage or ransomware scenario (Figure 8).

 

FIGURE 8: MODELLED LOSSES FOR SELECTED SCENARIOS, BY MAJOR CYBER CATASTROPHE VENDOR^a

 

Copy link to this section

^a The y-axis refers to annual loss estimates for a sample insurance portfolio for each model. The x-axis shows the associated return period – the likelihood of the estimated loss occurring on average within a given timeframe

Source: Gallagher Re calculations

 

A large driver of the differences in modelled losses reflects sensitivities to key input data. Variations in even simple Source: Gallagher Re calculations firmographic information – such as revenue, company name, industry or domiciled country – can have a significant impact on the loss estimates. Understanding how data quality drives model difference is therefore a key consideration of re/insurers when they compare model outputs. However, due to the lack of transparency about the models and their calibration processes, it is not possible to account fully for the divergent model estimates.

Over the years, estimated risk metrics for extreme cyber scenarios, though volatile, have converged across the main vendors as new model versions have been released. This is due in part to vendors relying on external feedback to recalibrate their models in line with re/insurance market views.83 As a result, the convergence may not necessarily reflect a better grasp of the underlying drivers of catastrophic cyber risks and hence more accurate estimates of the ‘true’ aggregate loss distribution.

While understanding of cyber risks continues to evolve, and until cyber insurance policies become more standardised, we should expect to see the loss models undergoing frequent and possibly significant updates before they reach maturity. The downside of frequent model revisions, however, is the burden they place on re/insurers that make use of cyber models to judge capital calculations as regulators require them to re-evaluate the models and reconcile the output each time. Vendors must therefore navigate a tricky path between model inertia and volatility, although in the absence of empirical data with which to independently calibrate the models, convergence across them should be avoided if it is driven by market sentiment alone.

Source: Contributed by Simon Heather, Gallagher Re

In light of the difficulties in quantifying cyber risks, most re/ insurers augment formal probabilistic models with deterministic scenarios to gauge the size of possible extreme cyber losses. These ‘what-if’ type exercises look to investigate the full scale of potential losses without necessarily attempting to enumerate the chances of such scenarios occurring. By careful selection, construction and analyses of different scenarios, re/insurers hope to gain increased visibility on the possible size and shape of the tail of the aggregate loss distribution. The scenarios may be informed by external vendor models, although re/insurers tend to develop their own narratives and estimates of realistic extreme losses, drawing on a wide variety of expertise across their business units (Figure 9).

Among the many possible adverse scenarios, the prospect of widespread business interruption – triggered by, for example, a malware or ransomware attack that indiscriminately affects multiple businesses or targets key internet intermediaries with resulting spillovers on other sectors’ operations – is currently of most concern to cyber re/insurers (Table 3). Previous empirical studies have shown that the economic costs of such a concerted cyberattack might rise to as much as USD 193 billion.84 And the losses borne by society could be many multiples of that if an attack disrupted or destroyed major critical infrastructure (such as a power plant), most of the associated costs of which would not be covered by cyber insurance given prevailing insurance coverage and exclusions.85

FIGURE 9: SCENARIO DEVELOPMENT BY RE/INSURERS (% OF RESPONDENT FIRMS)

Copy link to this section

Based on the results from a poll of 11 GA member cyber re/insurers, weighted by relative size of cyber insurance premiums 

Source: The Geneva Association

TABLE 3: RE/INSURERS’ RANKING OF EXTREME CYBER SCENARIOS

Refers to median ranking score assigned by survey respondents (1 being the highest-ranked scenario). Based on the results from a poll of 11 GA member cyber re/insurers

Source: The Geneva Association

A major drawback of pure deterministic scenario analysis, however, is the difficulty of establishing the credibility of associated loss estimates. The level of potential losses could be high yet so uncertain that even experts struggle to assess the different scenarios with any confidence. It may simply be too challenging to identify the full set of dependencies among risk factors, define scenario footprints and assess the impact of an event on the many companies that could be affected.86 Notaly, shifts in key assumptions about the degree of permanent destruction of both tangible and intangible assets (i.e. the extent of reversibility of an attack or non-malicious IT failure), the length of any outage in production as well as the time to recover or replace key inputs could all have a significant bearing on overall losses.

Over time, some of the uncertainty around possible extreme cyber losses will no doubt be reduced. Better data collection and analysis, claims experience from different cyber incidents and increased understanding of the underlying threats and vulnerabilities will increase re/insurers’ ability to assess and model cyber risks, not only attritional claims but also catastrophic losses.

Not all of the uncertainty around future cyber losses, however, can be resolved with increased information, enhanced knowledge and better modelling. Almost inevitably, a residual amount of irreducible uncertainty will persist, reflecting the impossibility to conceive clearly and exhaustively all the possible outcomes that could occur and the ambiguity over the probability of specific events and/or the magnitude of any consequences.87 In assuming risks from others, re/insurers need to be adequately compensated for the uncertainty surrounding future insured losses, including those that cannot be reliably modelled or quantified.

This situation is not unique to cyber. Even natural perils for which extensive historical information and the laws of physics provide significant insights about the likelihood and scale of possible losses are affected by structural change, the precise implications of which cannot be completely mapped. More formally, the world is subject to non-stationary forces – i.e. is not governed by unchanging scientific or behavioural laws – which can give rise to unprecedented and profound uncertainties. Climate change provides a classic example of such a shift that is leading to extreme weather events far outside the historical envelope of uncertainties that frame most natural catastrophe modellers’ views of such risks.88

Cast in this light, it is misguided to think that quantitative models will provide a definitive guide to cyber exposure management and/or underwriting. Instead, the value of such models is in thinking through simplified thought experiments about what is an ultimately complex, unknowable system. Put differently, some elements of cyber exposures extend beyond the reach of probabilistic reasoning, in the sense that we cannot attach meaningful numerical probabilities to all future outcomes or scenarios. Re/insurers therefore need to use model-derived estimates judiciously in order to avoid misplaced precision.

That ultimately there are limits to how far the frequency and severity of extreme cyber losses can be precisely quantified does not mean that such risks are completely uninsurable. The history of insurance is replete with examples where cover has been provided for new classes of exposure with limited relevant historical data and only partial understanding of the underlying risk drivers. The earliest insurance policies for the maritime sector, for example, were written without the benefit of full and detailed actuarial assessments.89

Some cyber exposures will almost certainly remain out of scope for re/insurers on grounds that possible accumulated losses far outstrip what the re/insurance sector can safely and sensibly underwrite. Most obviously, in line with other insurance lines, war-related cyber risks will continue to be excluded from standalone and packaged policies, even if market preferences over contract language have yet to reach a consensus. In the same vein, potential losses arising from disruption to major critical infrastructure may be so large, uncertain or too highly correlated that they bump up against and even overstep the boundaries of insurability.

But the perimeter of the set of insurable risks is not immutable. It shifts as the structure of information, knowledge and expertise as well as incentives influence ambiguities around potential tail events and attitudes towards them.90 In this way, societies over time can move closer to optimal risk sharing, which in the absence of ambiguity would allocate risks to those most willing and able to absorb them.91 In the case of cyber, the amount of achievable risk exchange will depend not only on the actions of those seeking to shed exposures and those willing to assume them. It is also affected by actions of governments that may end up bearing the bulk of losses from a catastrophic cyber incident as well as IT developers whose products and services individuals and firms have come to rely on but who may not fully bear the hidden costs they impose on others.

The dedicated cyber insurance market remains relatively concentrated. According to Insuramore, the top five re/insurance groups account for close to a third of premiums worldwide, a market share that rises to over 70% for the top 20 groups.92 Expanding the number of market participants could therefore boost overall risk-absorbing capacity for cyber exposures. As well as spreading the risks across more balance sheets, additional carriers might choose to locate at different attachment points (i.e. the thresholds at which insurance policies begin to provide cover) in the loss tower, depending on the relative likelihoods they attach to cyber perils and/or their risk appetite.

In fact, participation in cyber insurance markets has increased over time. Insuramore’s research shows that over 220 insurer groups were underwriting cyber risks on a direct basis by the end of 2022, an increase from over 180 in 2021. But reinsurance remains constrained, with limited options for re/insurers to lay off some of their exposure through retrocession. The majority of cessions are concentrated among the largest global reinsurers and the Lloyd’s market.93 As primary insurers grow more comfortable managing attritional losses, this might permit a shift away from proportional reinsurance to other structures (such as excess-of-loss) which might free up reinsurance capacity.94, 95

New institutional mechanisms to spread and share cyber risks have been created, although the incremental increase in overall capacity is modest. For example, a new syndicated cyber facility was launched in the London Market at the beginning of 2023 which provides up to GBP 50 million of excess layer capacity through Lloyd’s A-rated insurers.96 Similarly, leading European multinational industrial companies from different sectors recently formed a mutual insurance company to underwrite direct cyber insurance on behalf of its owner-members, albeit up to an initial capacity limit of EUR 25 million per member.97

Discussions are also ongoing in certain jurisdictions about the potential to create or extend formal private-sector re/ insurance pools to allow carriers to mutualise cyber risks, at least for certain types of exposure. In particular, press reports suggest that the U.K.’s Pool Re, originally created to share terrorism risks, is exploring how to expand its cover to state-sponsored or war-related cyberattacks.98 Likewise, ideas are reportedly being mooted in the Australian market that might eventually lead to a standalone cyber reinsurance pool focused on insuring commercial SME cyber risk.99

Enhanced ways to share information and experiences in underwriting cyber risks may encourage more re/insurers to offer cyber insurance. And again there are recent examples which suggest the industry is making progress in that direction. For example, in early 2023 the Oasis Loss Modelling Framework announced the launch of its new Open Exposure Data standard for cyber to promote consistency and efficiency in the capture and transfer of exposure data.100 Similarly, CyberAcuview, an industry consortium set up in 2021 by a number of leading cyber insurers, provides a coordinating framework to collate claims data for the U.S. market and share insights about the fundamental drivers of cyber losses, including possible systemic risks.101

Attracting additional risk-absorbing capacity from capital markets will be essential in creating a sustainable cyber insurance market; the size of possible extreme losses are too large and/or uncertain for the re/insurance sector to carry alone. The pool of investable funds from financial markets is much larger than the total insurance capital base, which is around USD 2 trillion.102 In 2022, global fixed income markets outstanding was USD 129.8 trillion, while global equity market capitalisation was USD 101.2 trillion.103

As explained in Box 5, there are signs of growing investor interest in cyber insurance-linked securities (ILS), although a number of hurdles must still be overcome. Potential lengthy coverage disputes over whether policy criteria have been satisfied and protracted negotiations over settlements do not sit well with end-investors who typically have a preference for short-duration financial securities and want ready access to the invested collateral upon maturity of the contract.104 Instruments with parametric triggers as well as moves to set up an independent body to categorise cyber catastrophe events might help boost investor interest in cyber ILS, although such initiatives are still nascent.105 Securities that look to tranche out first-party losses, which are likely to be shorter-tail than third-party liability claims, might also better match investors’ preferences.106

Limited liquidity is also an impediment to further expansion in cyber ILS. Compared with natural catastrophe bonds, for which there is an active secondary market, investors are more restricted in how they can sell-on or trade their cyber ILS positions. In part at least, this reflects the way transactions have been structured, and in particular doubts that the cyber securities can be easily traded. To the extent that new instruments could be designed to allow wider resale opportunities, this would in turn boost primary issuance of cyber ILS. Secondary market trading would also help illuminate investors’ views about extreme cyber uncertainties and, in turn, aid price discovery about the underlying risks and rewards.

Richer, more reliable models will foster engagement with cyber ILS market participants, especially if a new breed of more tech-led investors emerges with greater appetite for cyber risks. Arguably more important however, is enhanced disclosure by sponsors of securities that will enable ILS funds to become more comfortable with the exposure. Just like re/insurers, specialist ILS investors recognise the limitations of model-based risk metrics, especially for extreme cyber incidents for which historical benchmarks are limited. Since they are at least one step further removed from the underlying policyholders, ILS investors often look for a forensic understanding of how a cedent manages its underwriting in order to avoid major loss surprises in the transferred portfolio.107

Source: Contributed by Tom Johansmeyer, Inver Re

Given the potential for cyber intrusions to spread via online connectivity, one way for re/insurers to gain increased understanding of the potential for widespread losses is by collaborating with organisations that provide critical functionality of the internet. This could be especially important in expanding business interruption coverage for cyber perils. Companies such as the major CSPs have a unique vantage point to assess the cyber vulnerabilities of their users and the geographical/industrial footprint of attacks.

A number of partnerships have already been initiated between CSPs and re/insurers, albeit these remain nascent. For instance, Munich Re and Allianz partnered with Google to offer bigger policy limits for large U.S. customers of Google Cloud.112 By leveraging the internet giant’s cybersecurity expertise, including tools that scan workloads on the cloud and provide proactive security recommendations, the re/insurers benefit from insightful data about policyholders’ security posture. A similar collaboration is in place between AWS, Swiss Re and insurtech Cowbell to enhance the cyber insurance underwriting process for U.S. SMEs.113

Cooperation with government security agencies can also help to boost the governance role of cyber insurance in helping to identify and mitigate the financial impact of cybersecurity incidents. Enhanced threat intelligence could enable re/insurers to provide targeted alerts and risk-management suggestions for insureds, thereby improving policyholders’ cyber resilience.

Even with additional capacity from capital markets, there may be limits to the amount of cyber risk transfer that the private re/insurance sector can sensibly undertake. As government balance sheets might ultimately be called upon to absorb outsized uninsured losses should a major incident occur, it is rational to think about whether some form of government backstop facility could contribute to more efficient risk sharing. In principle, by cutting the size of catastrophic losses borne by private re/insurers and investors, such a backstop might encourage re/insurers to extend coverage and offer extra capacity. And to the extent that increased take-up of cyber insurance catalysed improved cyber hygiene and overall risk management, this might even make societies more resilient – decreasing the chances that a government facility would ultimately be called upon.

In this context, towards the end of 2022, the U.S. Treasury undertook a public consultation to solicit views about the potential benefits of a federal insurance programme for catastrophic cyber incidents.114 The sample of respondents was not entirely representative – notably, none of the major, global reinsurance companies submitted individual replies to the consultation. Nevertheless, at face value, the responses suggest some support for such a risk transfer mechanism or at least for exploring further the potential, both within and outside the re/insurance sector. At the same time, a significant proportion of respondents, including among insurance carriers, remain unconvinced that a public-private insurance arrangement for cyber is appropriate at the present time (Figure 10).

FIGURE 10: INDUSTRY VIEWS ON A U.S. FEDERAL INSURANCE FACILITY FOR CYBER RISKS

Copy link to this section

Based on 55 unique individual responses. Joint responses submitted on behalf of discrete organisations were counted separately. Carriers also include responses from industry bodies representing re/insurers while intermediaries refers to responses from brokers, rating agencies and model vendors

Source: The Geneva Association analysis of published responses to the U.S. Treasury consultation exercise

From the written consultation responses, a common theme among doubters (as well as some of those who are unsure) is a concern that any government backstop might have unintended consequences.115 This includes the potential for it to encourage lax cybersecurity among policyholders as well as weaken the incentives of insurers to promote good cyber hygiene and develop innovative insurance solutions. The cyber threat landscape itself could be influenced by the existence of a backstop to the extent that it encourages cyber adversaries – especially state-sponsored threat actors not solely motivated by financial gains – to exploit vulnerabilities that cause large and widespread losses knowing that a government may ultimately pick up the tab.116 Some market participants also worry that a government backstop would go hand in hand with a mandate for insurers to offer protection for all cyber perils, even those that are currently uninsurable.

These are legitimate reservations, although they arise for other public-sector coinsurance mechanisms that already exist for perils besides cyber, such as government-backed reinsurance schemes to protect against extreme losses from floods or terrorism attacks.117 They must also be balanced against the benefits such facilities provide. Suitably designed, calibrated and implemented, a cyber backstop could ensure that governments assume responsibility only for extreme losses beyond some agreed threshold while also aligning incentives to promote continued development and take-up of cyber insurance to boost societal resilience. This includes premiums to cover the cost of any government guarantee as well as procedures to claw back taxpayer-funded losses after a major cyber event.

Designing any backstop inevitably involves fine judgements, especially about the calibration of features such as deductibles and aggregate retention levels, as well as any scope for co-operative international solutions. There is no unique blueprint, although existing schemes offer clues as to what might work and what to avoid.118 As with other peak perils, any such facilities for cyber would need to be routinely reviewed and adapted to reflect the evolution in the understanding of cyber accumulation risks and who is best placed to absorb them.

Moreover, a government-sponsored backstop would not operate in isolation; accompanying public policy initiatives should aim to promote increased cyber resilience and/or reduce cyber threats. Governments can encourage minimum cybersecurity standards among firms, at least for entities with which they enter into commercial contracts, but more generally through sectoror industry-wide regulations. For example, in the U.S., The National Institute of Standards and Technology of the U.S. Department of Commerce has developed a voluntary framework for reducing cyber risks to critical infrastructure that could become a de facto legal standard through the operation of fiduciary and other legal duties of care.119

State involvement in standard-setting also extends to third parties whose conduct may create cybersecurity vulnerabilities for others but who may not bear the full consequences of their actions. Specifically, legislators and regulators could create tougher liability regimes for both IT hardware and software manufacturers as well as vendors who provide associated services. In the scramble to introduce new products, IT firms all too often pay scant regard to cybersecurity during the design phases, choosing to remediate flaws and bugs as they come to light in operation. By imposing higher duties of care or limiting liability indemnities, legislators could incentivise vendor companies to develop secure hardware and software that are more robust to cyberattacks.120

Such an approach is a core pillar of the recently announced U.S. national cybersecurity strategy, which aims to reduce overall cyber risk and shift the consequences of poor cybersecurity away from the most vulnerable.121 Details of any prospective legislation are yet to emerge, but some commentators highlight prospective new rules to:

• Limit software manufacturers from using contracts to shift liability to end-users
• Establish higher standards of care for software in specific high-risk scenarios
• Implement an adaptable ‘safe harbour framework’ to shield providers who securely develop and maintain their software products and services.122

As with government coinsurance, enhanced liability rules also have possible drawbacks. Notably, policymakers must navigate important trade-offs. Increased developer responsibility for cybersecurity could stifle or at least impede technical innovation while at the same time reduce competition if the fixed costs of compliance favour large firms over small ones.123 The cost of software upgrades might become prohibitively expensive for some users meaning known security vulnerabilities remain unpatched for longer. There are also practical challenges in crafting new liability rules and standards. For example, who decides when software is robust enough or how far to allocate responsibility if the underlying flaw was linked to OSS?

Despite these implementation challenges, attempts to ensure that the costs of externalities are borne by those who create them ought in principle to drive the IT market to produce safer products and services. In doing so, that will enable re/insurers to become more comfortable in assuming some of the aggregate tail risks associated with cyber incidents and in turn deploy more risk-absorbing capacity.