As Cyber-Insurance Market Stabilizes, Captives' Relevance Persists

While the commercial cyber-insurance market is stabilizing and perhaps even softening, there's still a place for captive insurance in organizations' cyber-insurance programs, a new white paper from Milliman contends.

"While cyber rate increases are slowing and even decreasing in some circumstances, rates are still significantly higher than they were prior to 2020," the Milliman white paper said, adding that those higher rates are likely here to stay.

The white paper, Is Cyber Insurance Still Relevant for the Captive Market?, notes that the commercial cyber-insurance market saw double-digit average rate increase in 2021 and 2022, with many insureds experiencing cumulative rate increases greater than 200 percent since the beginning of 2021, according to data from Guy Carpenter.

The cyber-insurance market hardened as a result of cyber insurers' recognition of their actual loss exposure, the report said. Meanwhile, data from Coalition, Inc., suggests that both the frequency and severity of US cyber claims during the first half of 2023 remained at their 2021 and 2022 levels.

That hardening in the cyber-insurance market didn't just affect rates, the Milliman white paper suggests. It also led insurers to reduce capacity, forcing insurance buyers to look to accept higher deductibles, self-insure, or turn to captives.

Employing captives in cyber-insurance programs offers several potential advantages, according to the Milliman white paper. One is that the captive can provide cyber-insurance coverage that may be unavailable or too expensive in the commercial market. In addition, the captive can help fill gaps left by exclusions in commercial cyber-insurance policies. And writing cyber insurance in the captive may also help diversify the risks written in the captive.

However, there are potential challenges to writing cyber insurance in a captive, the Milliman white paper said. One is losing access to the loss control and incident response resources that commercial cyber insurers may provide. But it is possible to structure cyber-insurance programs using captives in a way that maintains access to those resources, Milliman said.

Another potential challenge is a lack of alignment between the organization's risk management and information technology functions, making it difficult to implement risk control best practices, Milliman said.

In addition, cyber losses tend to be quite large, Milliman said, which could pose problems in the early years of a newly formed captive. For that reason, cyber risks may be best for well-established captives with a sizable surplus, the white paper said. An alternative would be for a captive to provide low policy limits or seek quota share arrangements for cyber losses.

Finally, the lack of publicly available cyber-loss data can make pricing and reserving difficult for cyber insurance, Milliman said.

Despite the potential challenges to writing cyber risk in captives, captives will likely continue to have an important place in cyber-insurance programs, the Milliman white paper suggests.

"Regardless of the state of the commercial cyber market, captive insurance companies can be an effective risk management tool to fill gaps in commercial coverage and provide reassurance to their parent companies," the white paper said.

The Milliman white paper was written by Kimberly W. Guerriero, principal and consulting actuary; Tea Bourdeau, actuarial analyst; and Sam Raphael, actuarial analyst.