US market premium drops in 2023 on declining written premium per policy

The US cyber market improved its loss ratio by 3 points to 42 percent in 2023 but reported that written premiums dropped 1 percent to $7.18bn, driven by falling written premium per policy, an analysis from Aon has found.

Aon’s ninth US cyber market update showed that US cyber insurance premiums reported to the National Association of Insurance Commissioners (NAIC) decreased 1 percent in 2023 to $7.18bn, driven by declining written premium per policy.

“The decline in written premium per policy is consistent with a cyber market that is known to have been softening,” the report said.

Aon said that the lack of growth in 2023 is attributable to a 3 percent year-over-year drop in standalone cyber written premium, which outweighed package cyber premium growth of 5 percent.

Discussing the report with Cyber Risk Insurer, Craig Kerman, managing director and actuary at Aon, noted: “This is the first time since the NAIC began collecting this data in 2015 that we did not see an increase in written premium. So the concern as we think about 2024 is that the decline in written premium per policy is going to continue to earn into portfolios.”

He added: “On a more positive side, the overall loss ratio for cyber improved from 45 percent to 42 percent. That’s in the face of declining written premium per policy and in the face of rising frequency, so it’s showing that the cyber market is remaining resilient so far.”

The 42 percent loss ratio was the lowest level since 2018. The 3 point reduction in 2023 was driven by increases in written premium per policy from 2022 continuing to earn into portfolios and reduced average severity.

The standalone loss ratio increased 1 point from 43 percent to 44 percent in 2023, with most standalone writers experiencing an increase. In contrast, the package loss ratio decreased 12 points from 48 percent to 36 percent.

Aon said the 2023 loss ratios remain at levels seen prior to the loss ratio spike in 2020-2021.

“Cyber insurance continues to experience higher volatility compared to many common lines of business; however, there was less spread in industry loss ratios in 2023 compared to prior years,” the report said.

Aon noted that increases in written premium per policy from 2022 continued to earn into portfolios in 2023. But it added that “declining standalone written premium per policy creates headwinds for 2024”.

Talking to Cyber Risk Insurer, Paul Preston, senior managing director – US cyber reinsurance broker at Aon, noted that policy count is increasing.

“Premium is relatively flat and you have a competitive rate environment, and that’s offsetting what we’re observing on the policy count side. The industry itself is growing, but given the competitive nature of pricing for underlying business we’re actually not observing that growth in the premium side,” he said.

In 2023, both standalone and package business policy counts increased while written premium per policy decreased.

For standalone business, policy count grew by 19 percent, which was offset by a 19 percent decrease to written premium per policy. For package business, policy count increased by 11 percent, outpacing the written premium per policy decrease of 4 percent.

Preston noted that the policy counts for standalone and package business are both at all-time highs.

“The take-up of cyber is continuing to grow. As the buyers of the insurance product continue to mature and expand, and as they understand the coverages that are being provided, the industry itself is observing growth,” he said.

Most standalone and package insurers experienced rising claim frequency in 2023.

“Frequency has risen in 2023 and will require further monitoring as declining premium per policy earns into the industry results,” the report warned.

Claim severity dropped for standalone business while there was a broad range of severity changes for package writers.

When asked whether premium will go back up in 2024, Preston noted that the stabilization in pricing that was expected to be seen early this year has not yet materialized.

“Looking to the second half of 2024, I think the CrowdStrike event is likely not an industry maker as far as pricing goes, but it does put people on notice that cyber has the ability to produce a systemic loss with disruptions to supply chain distribution,” he said. “That’s all-long tail in nature, and there’s going to be a huge push for increased aggregation management, data collection and transparency in coverage.

“These factors will start slowly contributing to a stabilization in pricing for the second half of the year.”

However, Preston does not expect an uptick in pricing soon.

“I don’t think that you’re going to see a big enough loss coming out of CrowdStrike, and it’s going to take some time for that to develop too,” he said. “Frequency is increasing but the losses just aren’t coming through. It’s a mature enough business where the attritional losses can easily be absorbed by the companies,” he said.

Number of insurers reporting cyber premium inches up

The report states that a total of 218 US insurers reported direct cyber written premium to the NAIC in 2023, up from 213 in 2022.

For insurers with larger cyber premium volumes, 106 insurers wrote more than $1mn and 59 wrote more than $5mn.

For standalone, the top 10 writers accounted for 58 percent of premium, down 4 percent year over year. Package business is far more concentrated compared to standalone, with the top 10 writers accounting for 71 percent of premium in 2023.

Market concentration for package business has been relatively static since 2021, with the top 10 writers consistently accounting for between 71 and 72 percent. In contrast, standalone business has experienced increased competition, as the top 10 writers have reduced market share each year since 2018.

Preston commented that major players will continue to hold market share, but new entrants will continue to enter the market.

“We’re working on a number of new opportunities right now with potential new carriers looking to get into the space. I anticipate additional numbers of carriers, whether that’s MGAs, E&S carriers, or established legacy insurers that have to date remained on the side,” he said.

In the report, Aon noted that its report reflects the performance of US business for US domiciled insurers, which is the data contained in the statutory supplement.

The NAIC publishes a limited amount of data in a separate source from alien insurers, but this data is not yet available for 2023.

“The US cyber market has experienced significant premium growth over the last five years, which is due to growth from both domestic and alien insurers,” the report said.

In 2022, the NAIC reported US cyber written premium of $9.64bn, with $7.22bn from domestic insurers and $2.42bn from alien insurers.

“For both standalone and package business, the proportion of written premium from domestic insurers has been increasing since 2020; in 2022, domestic written premium accounts for 71 percent of total standalone written premium and 86 percent of package written premium,” the report said.

Aon said that cyber remains a profitable line of business on average, with the company estimating a total US cyber combined ratio of 73 percent for 2023, with 77 percent for standalone and 64 percent for package.

“These results suggest that the margin for US cyber business has improved overall, as the average industry combined ratio decreased by 1 point year-over-year,” the report said.

For standalone business, the margin deteriorated year over year; however, improvements to the margin for package business led to an overall decrease to the industry combined ratio.

“Cyber insurance is a catastrophe-exposed line of business. Although there have been aggregation events, they have not had a major impact on performance and volatility through 2023,” the report said. “Aon has spent considerable time working with clients and models to set appropriate catastrophe loads and risk tolerances for cyber business.”

Aon suggested that, while US premium reported to the NAIC did not grow in 2023, events like the July 2024 CrowdStrike incident demonstrate the need for cyber insurance.

“In 2023, the cyber reinsurance market was bolstered with the introduction of catastrophe bonds. Therefore, there is reason for cautious optimism in cyber going forward,” the report said.

Aon also highlighted that performance differs by insured size.

The micro group has the lowest loss ratio of the three groups in 2023, estimated to be 26 percent in 2023. By contrast, the SME group’s estimated loss ratio in 2023 was 42 percent, while the large group’s loss ratio was 45 percent.

Less short-tailed than generally assumed

Other takeaways from the report are that, although the majority of cyber claims are first party, a rising proportion of third-party claims has been observed.

Preston said that this “indicates that cyber may be less short-tailed than generally assumed.”