As incidents of cyberattacks become more prevalent globally, the demand for cyber insurance continues to grow rapidly — much faster than most other lines.
For insurers, this provides an opportunity to meet growing consumer demand by increasingly offering cyber insurance policies, wrote DBRS Morningstar in a new commentary. But alongside opportunity, cyber insurance presents a different type of risk that needs to be managed.
Cyber can be difficult to price, as evinced by the now waning hard market the sector experienced during the last few years. And, that hard market only started softening due to, in part, tighter underwriting parameters and strict client controls.
For Canada, direct loss ratios for the industry (excluding public insurers) became less volatile as the industry matured. The accident-year cyber loss ratio rose from 36% in 2017 to a very high peak of 371% in 2020 before declining to -29% for 2022 as the industry released excess reserves, according to data from MSA Research and shared in DBRS’ commentary.
DBRS Morningstar Exhibit 3. Source: MSA Research
The evolving nature of cybercrime makes it difficult to garner comprehensive and credible data on cyber risk. That, plus the high level of technical expertise required to value the risk, makes cybercrime potentially catastrophic for insurers when a loss does occur.
“Appropriate policy terms and conditions and risk management measures that are effective in managing the volatility of the loss ratio and the containment of cyber-related losses are critical determinants in an insurers’ ability to manage underwriting cyber risk exposures,” credit rating agency DBRS wrote.
For insurers, finding suitable reinsurance coverage can mitigate further large losses and ensure business stability. However, the affordability of reinsurance may be a limiting factor in cyber market growth. Especially as reinsurance costs rose in 2023 for Canadian primary insurers and are expected to continue to increase, albeit more slowly.
Still, as the industry matures, insurers will be able to better manage systemic risk issues through underwriting, and policy limits and exclusions, which will lead to increased stability and underwriting profit.
Plus, insurers will gain more insights and data into what’s driving claims, enabling them to anticipate needed coverages and respond at a faster pace compared to traditional lines.
“Insurers offering cyber protection can benefit from a high demand source of revenue where the loss profile is uncorrelated to severe weather events,” wrote DBRS of the cyber lines advantage over other P&C lines.
There’s also opportunity for insurers to deepen their relationships with policyholders by offering value-add services like cyber risk mitigation tools and loss-mitigation responses.
In the near-term, cyber will see increasing restrictiveness in the type and amount of coverages insurers provide, given the unpredictability of the claims profile, DBRS predicted.
“The tightening of policy underwriting may result in lower take-up of insurance, which, while detrimental to growth in the short term, can improve the feasibility of cyber risk protection in the longer term.”
Feature image by iStock.com/KanawatTH
