CrowdStrike Outage Highlights Cyber Risk Aggregation Concerns for Insurers

The recent CrowdStrike outage has spotlighted the aggregation risks that worry the insurance industry, according to AM Best.  

Sridhar Manyem, senior director of industry research and analytics at AM Best, said, "CrowdStrike is exactly the kind of aggregation risk that the industry is worried about. One security bug or a software flaw has the potential to bring down businesses such as airports, the aircraft industry, financial institutions, or software companies. The interconnectedness of systems was in full display last week and demonstrated how businesses can be brought to a standstill abruptly and on a large scale. This incident is likely going to impact multiple insurers."  

While current loss estimates are still preliminary, Mr. Manyem added, "We do not know yet the full impact on insurers, but we think this could be an earnings event due to underwriting terms (limits, higher deductibles) and reinsurance. Insurers have been tightening underwriting standards through increased retentions, manageable limits, shifting their focus to small and medium-sized enterprises, the use of reinsurance, etc. This is still developing and has the potential to be a contracted claims and legal process, and we will be monitoring the situation. This event serves as another example why cyber is such a dynamic market and clients/insurers need to be on top of emerging issues."

In its latest report, US Cyber: Hot Pricing Cools Off, Rapid Growth Stalls, AM Best said the US cyber insurance market saw a significant slowdown in premium growth in 2023, with direct premiums written rising by only 0.1 percent from 2022. This is a stark contrast to the substantial growth observed in previous years.  

Despite the increase in the number of policies, the market remains stable due to improved cyber practices that have helped minimize claims severity. Surplus lines insurers continue to dominate the market, benefiting from their ability to quickly adapt policy forms to meet changing needs. The market outlook remains stable, but systemic risks, risk aggregations, and the challenges posed by artificial intelligence are key concerns.  

Additionally, while larger, sophisticated insureds already have coverage, future growth is expected to come from small and medium-sized enterprises moving to digital platforms, often opting for packaged policies for ease of management. 

The CrowdStrike outage underscores the aggregation risks faced by insurers, highlighting the necessity for vigilant underwriting and reinsurance strategies. 

Copyright © 2024 by A.M. Best Rating Services, Inc. and/or its affiliates. ALL RIGHTS RESERVED.