CyberCube’s Millaire: Cyber modelling transformed from being “interesting” to “useful”

CyberCube’s CEO Pascal Millaire said that his firm’s accurate predictions of industry loss ratios in recent years have been “proof points” in the maturity and validity of cyber modelling and said cyber models have gone from being “interesting” to being “useful”.

Millaire – who has led CyberCube as its CEO since the beginning of 2018 – spoke to The Insurer TV on the sidelines of last week’s NetDiligence Cyber Risk Summit in Miami, where he discussed the evolution of cyber modelling, parallels to property cat, and insurtech conditions.

He also predicted that the size of the cyber cat bond market could ultimately surpass that of the property cat bond market over time.

CyberCube – which is backed by the likes HSCM Ventures, Stone Point, Forgepoint Capital, and MTech Capital – has raised $150mn since launching in 2017 and has set out a goal of exclusively focusing on solving cyber risk modelling challenges in the insurance industry.

Asked to comment on the current state of cyber modelling, Millaire said that the capability of the segment “has come an incredible way” in the last five to eight years.

Millaire also acknowledged industry scepticism towards cyber modelling, but argued that with several years of experience under its belt, it has proven to accurately model cyber industry loss ratios.

He used as an example CyberCube’s prediction of a 61 percent cyber industry loss ratio for 2021, which came in 4 percentage points below the 65 percent figure published by the National Association of Insurance Commissioners, and that in 2022, CyberCube was off by only 1 loss ratio point.

“So, I think about the years that have gone by, the level of investment that's gone in, and the proof points that are out there, which suggests that the modelling industry has gone from what some described as ‘interesting’, to now useful,” MIllaire said in the interview.

Cyber cat bond market could overtake property cat bond market

He also pointed to the “billions of dollars” of (re)insurance transactions placed on the basis of modelled outputs and how cyber ILS as third-party capital have come to rely on the insurtech’s models to price risk for major transactions.

“Modelling firms like CyberCube have been helping to drive the development,” Millaire explained, calling the traction of cyber ILS deals in 2023 “a huge barometer of confidence”, noting that those deals made up 7.5 percent of all ILS issuance in last year’s fourth quarter.

“So, coming from a near standing start, that is a remarkable start for the cyber-ILS market, but I think we're only just beginning as we think about the size of cyber risk today. [Given] the size of cat cyber risk today, the growth projections for this market, conceivably, you could see a cyber ILS market as big if not larger than the net cat cyber market over time,” Millaire argued.

“To get there, though, I think that took a lot of work on behalf of modelling firms, structuring agents and sponsors to inspire confidence in this as a new asset class,” he continued.

“But I think the fact that we got off to such a strong start in Q4 that we had bonds that were oversubscribed, we have other sponsors looking to bring new instruments to market this year, suggests to me that we're just at the very beginning of what could be a great new source of cat capital to fuel the growth of this market,” the CyberCube explained.

CEO says cyber has been able to “leapfrog” pace of development of property models

Millaire said that cyber modelling has been able to “leapfrog” the pace of development of property cat models by adopting lessons learned from their development, as he also said that feedback from the insurance industry had helped his company refine its models.

“We're able to leverage the incredible advances and the public cloud in terms of delivering those models in a seamless way to clients,” he said, adding that the industry now has “a lot of experience” with cyber claims and losses.

Just last month CyberCube uploaded “hundreds of thousands” of companies’ exposure data into its model and each month has thousands of broker submissions uploaded into its platform, while it works with clients who in many cases have paid out thousands of claims to calibrate its model.

He said the company has taken those steps to “make sure every time we undertake a release, we're reflecting the dynamic risk landscape that exists within the cyberspace”.

“So, I think the more the market grows, the more policies are enforced, the more insurers see that exposure broker in claims data, the better the models are, the better the feedback that we get,” he explained.

He also said that the insurance industry is now “starting to teach the cybersecurity industry” about good and bad cybersecurity practices based on loss data connected to insureds’ cybersecurity postures.

“So, it's an incredibly exciting time for the cyber modelling industry within insurance, but also exciting as you think about the role that insurance can play in creating a more resilient global economy to cyber risk,” he explained.

Industry data provides feedback loop for calibration

Millaire said CyberCube is continuing to invest in its single risk and cat modeling tools to tie “security signals” to claims and losses.

“One of the great developments of ransomware was [that] insurers looked at companies like CyberCube to find signals such as open RDP ports that were leading to claims,” Millaire commented.

“Subsequently, our team of data scientists and actuaries continue to do work to find signals that are even stronger than those open RDP port signals that are predictive of claims, things like end-of-life products, signals, things like misconfigured websites, the existence of ransomware toolkits that are observable on an enterprises network,” he continued.

Millaire was also asked how his firm is keeping pace with rapid changes in threat actor behaviour, breach victim responses, and changes to coverage terms and conditions, including wordings.

Outside of accident years 2020 and 2021, the CyberCube said the cyber industry has been “remarkable” in its absence of volatility, pointing to the strong underwriting response in those years by insurers to stabilise the segment’s loss ratio.

“So, I would say despite all the challenges or the dynamism in the space, the industry now has a decade-plus long track record of actually getting this right,” Millaire commented.

The CEO also commented on his experience leading an insurtech amid a tough funding environment for the industry subsector.

“CyberCube is in the fortunate position of being in perhaps the most attractive segment of insurance over the course of the next couple of decades, with a software-as-a-service operating model, with exceptional underlying business metrics, and being seen as a clear leader in the space,” explained.

CyberCube recently announced it has signed over 100 insurance clients, including 30 of the 40 largest US and European cyber insurers and 11 of the top 20 global cyber brokers, while noting that the company raised an additional $50mn in funding in late 2022.

“I think for those insurtechs and tech companies with strong underlying business models, solving important problems with leadership positions in those markets, there's certainly an abundance of capital available for companies like CyberCube to be doing that,” he concluded.

Watch the full Insurer TV interview with CyberCube’s CEO Pascal Millaire to hear more on: