US Cyber-Insurance Market Saw Dramatic Premium Growth in 2022

The US cyber-insurance market saw direct premiums increase by 50 percent in 2022 to $7.2 billion, while improved loss ratios demonstrated insurers' increased underwriting discipline, according to a report from A.M. Best.

The Best's Market Segment Report US Cyber: First Hard Market Cycle Brings a Return to Profitability said that US direct premiums written for cyber insurance have tripled in the past three years as demand has surged. Growth in the cyber market has outpaced that of the broader commercial lines insurance market by a wide margin, the rating agency said.

The US cyber-insurance market's 2022 improvement came after 2 difficult years, as cyber insurers benefited from continued rate increases, tighter underwriting, and a decrease in ransomware attacks, Best said. Compared to 2021, the market's loss ratio fell 23 percentage points to 43 percent on standalone cyber policies and by 18 percentage points to 48 percent on packaged policies.

"Underwriters have used every item in the proverbial toolbox to manage exposures. In addition to the rate increases, underwriters have cut limits, increased insureds' own retention, and improved risk selection," Christopher Graham, senior industry analyst, industry research and analytics at A.M. Best, said in a statement. "With the cyber universe expanding and becoming more complex with artificial intelligence creating new exposures and ransomware attacks returning to prominence in 2023, the demand for cyber coverage will only increase."

According to Best's report, the cyber-insurance market continues to shift away from package policies as standalone coverage becomes the preferred option among insureds. More than 70 percent of cyber premium is now written on standalone policies, Best said, adding that the move to standalone coverage may reduce coverage disputes and litigation costs.

The Best report noted another market shift, with surplus lines writers now accounting for nearly 60 percent of total cyber market premium, up from the approximately 25 percent share they held consistently from 2015 to 2020.

Even with the decline in ransomware claims during 2022, first-party claims remained close to 75 percent of the nearly 27,000 reported cyber claims during the year as business email compromise claims increased, Best said.

Best noted that cyber war risk exclusions vary by company, with some insurers sticking with traditional war exclusions and others accepting certain war exposures.

"Systemic risk is an ongoing concern. Property catastrophes typically affect a limited geographic area, but a cyber catastrophe, as we saw with NotPetya, can go worldwide," Fred Eslami, associate director at A.M. Best, said in the statement. "As the definition of war becomes broader, so may the exclusion as well, which could lead to insureds with less coverage. Ultimately, the coverage provided to insureds may be decided by the risk appetite of the insurer, and to a certain extent, the coverage that reinsurers are willing to provide."