As Cyber Underwriting Improves, Market Poised for Second Growth Wave

The property-casualty insurance and reinsurance market is well on its way to a transition to a property-casualty-cyber market, a recent report suggests. By 2040, the cyber market will be comparable to those for property or casualty, according to the report from Gallagher Re, and will have surpassed them in terms of annual reinsurance premium.

The report, CY-FI: The Future of Cyber (Re)insurance (Gallagher Re, February 2022), suggests that an underwriting revolution began in the cyber market in 2020. Cyber reinsurers and insurers are now looking to deploy their capacity to better-quality risks, the report says, with the underwriting revolution setting the stage for future growth in the market as a growing appetite for cyber risk will arise from its growing profitability.

Gallagher Re suggests that a second growth wave for the cyber-insurance market could begin in 2023 as decreasing loss ratios, increased confidence in underlying risk quality, and limited actual losses from high-profile cyber events raise insurers' and reinsurers' confidence.

Meanwhile, capital inflows will bring positive changes to the cyber-insurance market, the intermediary says, including investment in understanding and mitigating potential losses through technology-led solutions.

"From 2025, increasing clarity over cyber's future as an insurance heavyweight buoyed by market confidence in the ability of data to predict claims will drive a 'data arms race' by reinsurers and cyber-security vendors as scale is required to fully realize technology potential in loss ratio improvements," the report says. "We expect this convergence between technology solutions, cyber-security techniques, and reinsurance will create a virtuous cycle, as investors seek to protect their capital invested in the space."

The Gallagher Re report describes rate changes in the cyber market over the past year as unprecedented, citing portfolio increases ranging from 35 percent to 113 percent in 2021. Those "headline-grabbing" rate increases are likely to continue in 2022, the report says.

"Similar to the past 2 years, these rate increases will be most acute for those purchasing insurance in the latter half of the year, reflecting underwriters' efforts for pricing adequacy," the report says.

While the increases are leading to rate adequacy for cyber insurers and reinsurers, rates will likely continue to increase in the near term, Gallagher Re says. "This is due to the continued capacity crunch and the market's 'premium problem,' which results from business planning being conducted on a premium basis rather than an exposure basis," according to the report.

The report notes that demand for cyber insurance continues to grow as ransomware attacks are prompting organizations to pay greater attention to cyber risks and elevating the issue to a board-level concern.

The historic levels of rate increases in the cyber-insurance and reinsurance market have overshadowed what Gallagher Re suggests is a bigger story: the underwriting revolution the market experienced in 2021. Underwriting questionnaires have become more targeted, the report says, with many in the industry using specific ransomware questionnaires focusing on the controls proven effective at preventing or mitigating incidents turning into claims, such as multifactor authentication and well-placed segregated backups.

Other underwriting tactics being employed as a result of the "revolution" include the tightening of terms such as sublimits, coinsurance, and deductibles; stronger exclusionary language such as broader infrastructure exclusions; and coverage restrictions such as for contingent business interruption, according to Gallagher Re.

In addition to those underwriting changes, the cyber-insurance industry is also looking to technical solutions to help in risk selection, pricing, and portfolio optimization, the report says.

"This adoption will continue to muster pace in 2022 as these technologies are integrated to: improve risk selection and underwriting, evaluate exposure to single points of failure in existing portfolios, and offer post-bind services in order to prevent claims by notifying potentially exposed insureds as an incident unfolds," the report says.

The Gallagher Re report suggests that the increased use of technology in the cyber market goes beyond underwriting and pricing. It includes such things as insurers using external scanning technology to help their insureds respond to emerging and time-sensitive cyber events, the report says.

The combination of improved underwriting terms, efforts to optimize portfolios, and the adoption of new technologies will contribute to a return to profitability for the cyber market over the next 18 months, Gallagher Re reports, with the impact possibly being seen in industry loss ratios for 2022.

The impact of the underwriting revolution should result in greater confidence among capacity providers in the cyber market, the report says. Those underwriting changes—particularly improved use of cyber data and targeted questionnaires—will produce significant improvement in the quality of insureds, according to Gallagher Re.

"Furthermore, the same data insurers have begun to harness in the underwriting revolution will enable stronger portfolio optimization and the ability to shed the worst-performing risks, again providing uplift to the quality of the underlying risk," the report says. "This improvement in insurers' ability to 'cherry pick' companies with greater cyber-security maturity is further benefited by overall improvements in risk quality by insureds and prospective insureds alike."

Looking forward, Gallagher Re predicts that an influx in capacity and new players in the market between 2023 and 2025 will prompt insurers and reinsurers still uncommitted to the cyber market to enter the space.

If the cyber market continues to grow at its current pace, it will double in size every 3 years, Gallagher Re says. Meanwhile, its reliance on the reinsurance market will remain heavy.

In addition, the maturing of cyber-aggregation risk modeling combined with greater trust in the ability of technology to adequately quantify and predict cyber risk will lead to a greater role for the insurance-linked securities market in addressing cyber risk, the report says.