The Evolution of Cyber Insurance: The Role of Capital and Risk Transfer
A recent analysis by the Geneva Association (GA) has underscored that to sustain the growth trajectory of the cyber insurance market, additional capital will be imperative to manage increasingly complex cyber threats. The report delves into the potential of alternative risk transfer (ART) mechanisms, including insurance-linked securities (ILS) like cyber catastrophe bonds, to enable a wider distribution of these risks into financial markets.
Darren Pain, the director of research and head of cyber at the GA, explained that the report’s origins predate the surge of private cyber cat bonds issued in early 2023. These bonds, alongside subsequent 144A cyber bonds, indicate an emerging interest among financial investors in assuming catastrophic cyber risks. However, the central question remains: is this risk transfer market poised for rapid expansion, or will its development be more gradual?
“I think the punch line of our report is the latter,” Pain remarked. While there are positive developments in structuring these deals and educating investors, several hurdles must be addressed before cyber ILS becomes mainstream.
Challenges Facing Cyber ILS
Pricing Concerns: Pain highlighted that the current cost of capital from third-party investors remains relatively high due to the uncertainty surrounding cyber risks, which many still struggle to assess and quantify accurately. Consequently, a significant novelty premium is likely embedded in the required returns on cyber ILS. For substantial capital transfer from the reinsurance sector to capital markets, this cost must decrease.
Contract Certainty: The Geneva Association’s research identified three principal challenges, beginning with doubts over contract certainty. The absence of policy standardization in primary cyber insurance policies and related reinsurance contracts has made some investors wary, as they lack a comprehensive understanding of the cyber risk profile, potential triggering events, the timeline of a cyber incident, or whether non-cyber policies might be included within the ILS contract.
Market Participation: The second challenge concerns the limited participation in this marketplace. While a few high-profile investors are willing to accept this novel risk, their numbers, as well as the level of exposure most are prepared to take on, remain limited. In contrast, property ILS might involve 30-40 investors in a natural catastrophe bond, whereas cyber ILS risk is concentrated among a smaller pool of investors.
“There’s limited participation, not only in the primary issuance market. ILS in general – and this is not exclusive to cyber – is relatively illiquid with limited secondary trading,” Pain explained. “Most people who invest in ILS are ‘buy-and-hold’ investors, who trade out of their positions infrequently when they need to rebalance their portfolios.”
Structural Considerations: The third challenge involves questions about whether cyber risks genuinely diversify investors’ portfolios. “It’s a big elephant in the room,” Pain stated, “because we just don’t know. We haven’t observed enough peak cyber events to be confident about the interactions with other financial market instruments, such as corporate bonds and equity markets, that might lead to correlated returns across asset markets.”
In the event of a significant cyber incident, the question is how far it would impact market perceptions regarding the creditworthiness of the attack’s victim or others potentially vulnerable to similar attacks, as well as these firms’ earnings potential.
“We might envision a scenario where, depending on the incident’s nature, there would be significant financial market impacts correlating with a cyber event,” he said. “That’s typically not the case with a natural catastrophe like an earthquake, which is part of why some investors prefer to include natural catastrophe ILS in their portfolios. It provides a natural diversification to their other types of holdings. That’s not assured in cyber. People have to evaluate the diversification benefits of adding cyber to their portfolio, and there’s some caution about that currently.”
Prospects for Cyber ILS and ART Solutions
Despite concerns regarding the cost of capital and other issues hindering cyber ILS growth, the GA’s report remains optimistic about the bonds that have emerged and their potential to catalyze further risk transfer. However, Pain noted that the development of ART solutions in cyber is expected to be gradual rather than experiencing a sudden surge. This gradual evolution mirrors other nascent ILS or securitization markets.
“Typically, they do develop quite gradually,” he said. “There might be catalytic events that spur expansion. For example, post-Hurricane Katrina in 2005, there was a significant increase in natural catastrophe bonds due to capacity shortages in the reinsurance sector, influencing cedents’ willingness to pay for capital. In principle, similar catalytic events may occur in cyber, but most likely, the expansion of the cyber ILS/ART market will be gradual and steady, rather than sharp and rapid. That’s our take on the outlook anyway.”
