The value of cyber industry loss indices to support a sustainable market

Perils’ Darryl Pidcock discusses the importance of industry loss triggers in supporting the sustainability of the rapidly evolving cyber market.

Cyber insurance is one of the fastest-growing product lines with global written premiums estimated at $14bn in 2023. This increasing demand for cyber protection presents opportunities, particularly as insurers increasingly offer stand-alone cyber policies.

However, in tandem with growing opportunities, there are increasing industry challenges especially regarding understanding cyber risk exposures and managing systemic risk accumulation. It has become increasingly important for insurers and reinsurers to find ways to actively manage accumulation risk through traditional reinsurance, retrocession and alternative capital markets.

There are various ways to manage such exposures including using the ILS and the privately traded industry loss warranty (ILW) markets. Reports show that in excess of $580mn in new cyber risk ILS transactions have been issued within the last 12-18 months as well as some private ILW deals.

This includes some transactions using an industry loss trigger, which is a staple of nat cat ILS and ILW transactions. As protection buyers look to manage their exposure to systemic loss events, industry loss triggers can play an increasingly important role in international retrocession markets to offer sustainable capacity to the cyber market.

There are benefits for retrocession buyers regarding the need to disclose proprietary portfolio information, which is often highly complex and constantly moving, especially for cyber. Industry loss triggers require much less disclosure for buyers, while the risk assessment is more straightforward and transparent based upon the industry loss. This can be attractive to both protection sellers and buyers if the risk assessment is well understood, disclosure requirements are manageable and basis risk is acceptable.

Twelve months ago, Perils and CyberAcuView jointly launched the US Cyber Industry Loss Index in response to increasing demand from the industry to create an index specifically for cyber losses, like those available for nat cat. The index has already been used for both ILS and ILW cyber-related transactions.

Many stakeholders including reinsurers and ILS funds have shown interest in entering the cyber market while others continue to invest time to better understand the risks. The use of the industry loss index is an efficient alternative to enable access to capital for protection buyers while building sellers’ confidence in cyber risk-related transactions.

As we engage more fully with industry practitioners, there have been several critical themes consistently raised, including:

1. A lack of major historical systemic loss events

2. Development of cyber modelling including access to industry loss data

3. Accessing and understanding reliable industry exposure information

4. Primary and reinsurance industry event definitions and how they are applied in the market

5. Correlation risk across cyber transactions

Addressing these important topics can help the industry better understand the cyber risk landscape as this market evolves.

In addition, the industry has arguably been focused more on malicious/intentional attacks to date. The recent CrowdStrike event has created an opportunity for the industry to invest greater resources into understanding accidental/unintentional loss events, especially in critical areas such as policy coverage and exposures.

While the Perils-CyberAcuView index only reports intentional/malicious events in excess of $500mn, we have also been actively engaging with stakeholders regarding recent events. In response, we are currently considering feedback regarding accidental/unintentional loss events and will communicate with the market as soon as possible.

Understanding systemic cyber risk and improved access to capacity for protection buyers will be critical to supporting the expected significant growth in cyber insurance over the years to come. In conjunction, the availability of cyber industry loss information for use in alternative capital transactions will be key to sustaining that market going forward.

Darryl Pidcock is head of Perils cyber and Asia Pacific