Attracting Sufficient Capital Remains Cyber Market's Top Challenge

Despite recent capacity increases in the cyber (re)insurance market, attracting sufficient levels of capital remains the market's greatest challenge, a new white paper suggests.

According to the Gallagher Re white paper, titled The Vital Role of Capital in Cyber (Re)insurance, despite those recent capacity increases, the amount of capital entering the cyber (re)insurance market remains insufficient.

But, the May 2023 report notes, the cyber-insurance market's underlying dynamics differ from those of other insurance classes because of the growth opportunities that exist. The customer base, both in terms of developing new products and expanding into new territories, is growing for cyber insurers and reinsurers, according to Gallagher Re.

Meanwhile, insurers' and reinsurers' more stringent underwriting, portfolio optimization, and better use of technology have improved their performance, the white paper says.

The paper also cites cyber insurers' and reinsurers' response to ransomware losses as evidence of the market's ability to respond quickly and effectively to events that threaten their performance.

"The common wisdom of insurance market dynamics would conclude that increasing capital flows will eventually spawn a problem for the class, perpetuating the softening of rates and broadening of coverage," the Gallagher Re paper says. "Indeed, we already see evidence of rate stabilization and even rate softening in some parts of the cyber market, driven in part by the increased number of participants.

"But what if the cyber (re)insurance market is different from all other insurance markets where the increasing supply of capital would actually fuel an increase in demand for cyber (re)insurance," the paper continues.

In explaining how capital could stimulate cyber-insurance market growth rather than soften terms, Gallagher Re pointed to cyber insurers' and reinsurers' market-wide "swift, wholesale, and corrective action" in response to ransomware losses in the 2019 and 2020 underwriting years.

The improved portfolio performance resulting from rate increases, underwriting portfolio optimization, and more effective use of technology resulted in a larger number of cyber insurers looking to take on additional exposures and premium, Gallagher Re says.

"This increased capacity is likely to intensify as we see the cumulative impact of these changes track through the claims development triangles over the coming quarters which, in turn, will attract a further influx of capital," the white paper says.

While conceding that that influx of capital could put downward pressure on cyber (re)insurance pricing and coverage over the short term, the white paper says Gallagher Re believes that the underlying dynamics of the cyber (re)insurance market are different from those of other underwriting classes. A wave of additional capacity would not create sustained softening as it would in other lines, Gallagher Re says.

"This is because of the unique growth opportunities available to cyber (re)insurance," the white paper says. "In the last few years, innovation has been stymied in what has, in its short history, been a very creative class of business."

The cyber (re)insurance market was forced to focus on remediating ransomware losses while insurers and reinsurers achieved their subsequent premium plan targets from underlying rate increases alone. That led to a stagnation in product offerings and curbed territorial expansion, Gallagher Re says.

"However, as rate increases decelerated, this dynamic diminished as a means to achieving top-line growth," the Gallagher Re white paper says. "We now expect to see the market pivot to attract a broader customer base both in terms of developing new products and expanding into new territories where penetration rates are low and demand for cyber (re)insurance is increasing."

Achieving that new product development and expansion into new territories will require both innovation from established insurers and reinsurers and the support of managing general agents, according to Gallagher Re. That will require cyber insurers and reinsurers to increase both risk aggregates and tolerances, in addition to more capital to support demand.

"This stimulation in growth and profitability will likely attract further investment, in turn compounding further growth," the white paper says.

Gallagher Re says that cyber (re)insurance can never be overcapitalized while the current demand and supply situation exists.

"Coupled with an ever-increasing digitized world and the growing dependence on cyber insurance and its associated cyber security services, the cyber (re)insurance market (having already demonstrated with its response to ransomware losses) will have the ability to pivot faster and more effectively than most insurance lines of business in the event of any significant deterioration in performance," Gallagher Re says.

While traditional cyber (re)insurers will likely remain the core form of capital addressing cyber risks, Gallagher Re says capital markets will probably play a growing role in addressing cyber risks over time. Thus far there's only been modest growth in tapping insurance-linked securities (ILS) to address cyber risks, however, due to a variety of challenges, the paper says, with investors moving slowly to understand cyber risks.

"Investors are taking their time to understand and study prospective cyber cedants—and perhaps look to support fewer of them in a more significant way than in property catastrophe—with the intent to 'turn on the tap' of capacity with their selected partners as 'proof of concept' develops," Gallagher Re says. "There is evidence of a number of major property ILS investors transitioning into cyber; over time we may even see a completely new breed of investors (perhaps more tech-led) to make up the core of the cyber (re)insurance investor base."

The Gallagher Re white paper was written by Ian Newman, partner, cyber, at Gallagher Re; Theo Norris, cyber account executive, insurance-linked securities, at Gallagher Re; Ed Pocock, senior cyber security consultant at Gallagher Re; and Ryan Fitzpatrick, chief operating officer, Gallagher Securities.