Reframing Cyber Risk: Opportunity or Serious Threat?

Opportunity or serious risk?

The perception of cyber-risk threats has significantly amplified in today's dynamic global risk landscape, at times painting a picture of imminent digital disaster, says global insurer Howden.

In its report titled Reframing Cyber Risk: Navigating Threats and Embracing Opportunities, Howden says that the foregoing pessimistic view of the cyber landscape may be "captivating, [but it] overshadows an important reality: the cyber (re)insurance market is not just a story of risk but a realm of untapped potential."

The May 9, 2024, report analyzes the intricacies of writing cyber risk, juxtaposing it against traditional natural catastrophe (nat-cat) risks, unveiling what it considers a compelling case for the cyber (re)insurance opportunity.

Howden advocates a recalibration of the risk appetite within the (re)insurance industry, urging a shift toward a more balanced and informed approach to cyber-risk underwriting.

"This recalibration is not merely a strategic adjustment, but a necessary evolution to capitalize fully on the cyber (re)insurance opportunity," Howden says. "The most advanced carriers are embracing refined risk models to navigate the nuances of cyber threats more effectively, transforming perceived vulnerabilities into competitive advantages."

The discourse around cyber threats often veers toward the catastrophic, the report points out, drawing parallels with the most devastating natural disasters.

Actual data and trends within the cyber (re)insurance landscape, to date, however, paint a markedly different picture, the report says. "The frequency and impact of cyber events, while not negligible, are constrained by numerous factors, including the logistical complexity of orchestrating widespread cyber-attacks, advancements in cybersecurity, the intrinsic motivations of threat actors, and the diversified uptake of, and reliance on, different technologies by different profiles of insureds."

A critical insight from Howden's analysis is "the comparative hesitancy of cedents to underwrite cyber risk versus traditional nat-cat risks. This is despite evidence suggesting that the use of cyber reinsurance offers a favorable risk-return profile.

"Our findings highlight a persistent underestimation of the cyber opportunity, with larger carriers assuming comparatively greater exposure to nat-cat risks," Howden says. "This relatively conservative stance towards cyber risk is belied by a backdrop of historical data (despite its short history), which suggest that premiums have, in most years, outpaced losses in the cyber domain, as was not the case in several high-profile nat-cat underwriting years."

Some insurers and reinsurers have used the lack of data and the difficulty of pricing the risk as justification for avoiding the cyber market altogether.

In an analysis of 16 insurers, Howden found marked variability in cyber-risk underwriting strategies, evidenced by gross loss distributions that mirror the diversity of underlying portfolios, "demonstrating that portfolio composition significantly influences tail-end loss experiences."

Portfolios focused on small and medium-sized enterprises, "displaying large modeled aggregate annual losses, tend to exhibit a flatter loss curve, suggesting a broad risk spread," the report says. "In contrast, portfolios in the median range, typified by their diversification, adhere more closely to industry averages."

Entities with a substantial share of high excess policies are susceptible to rare but severe events, Howden says, creating a stark distinction between average loss and cat risk. "Additionally, the variation in net results underscores differing carrier appetites, informing distinct reinsurance buying behaviors. For the industry to grow profitably within the cyber domain, it is important that cedents optimally employ reinsurance as a mitigation tool."