US Cyber Insurers Saw Improved Performance in 2021 as Loss Ratio Drops

US cyber insurers improved their performance in 2021, with the sector's loss ratio decreasing 1 percentage point from the prior year to 66 percent and premiums increasing significantly to keep up with increased loss severity, according to a report from Aon.

"If 2020 was the year cyber loss ratios increased significantly, 2021 was the year insurers fought back and stemmed the tide against rising trends," Aon says in its US Cyber Market Update (August 2022).

The Aon report is based on an analysis of data from the National Association of Insurance Commissioners (NAIC) statutory filing supplement.

"Of course, some insurers performed significantly better than the industry total while others did notably worse," the report says. It notes that the median loss ratio is lower than the industry-wide figure, suggesting the total is skewed upwards by companies with higher loss ratios.

Aon found that among underwriters with at least $5 million in direct written cyber-insurance premium, loss ratios ranged from below zero at the low end to as much as 669 percent.

"Indeed, cyber insurance continues to experience higher volatility compared to many common lines of business, and this volatility rose even further in the past year," the report says.

According to the Aon report, 214 US insurers reported direct written cyber-insurance premium to the NAIC in 2021, up from 200 in 2020. Most of the new participants were small, Aon says, although a few of the new market entrants were writing into the millions of dollars of cyber-insurance premium. The new entrants to the cyber-insurance market reflect demand for cyber insurance as some incumbent insurers are limiting their capacity, the report says.

The group of cyber insurers reported $4.83 billion in premiums in 2021, a 76 percent increase from the prior year, according to the report. Aon notes that the growth of stand-alone cyber-insurance products was higher than the total with 94 percent year-over-year growth versus 49 percent for cyber insurance written as part of package policies.

Aon suggests that the cyber-insurance market became more competitive in 2021, with the top 10 cyber insurers responsible for 58 percent of direct written premiums, down from 68 percent in 2020.

The report says that loss ratios decreased for stand-alone cyber-insurance policies in 2021 while they increased for package policies. At 66 percent, the 2021 loss ratio for package policies was at its highest level since 2015, when the NAIC began collecting the data, Aon says.

Earned income per policy increased for both stand-alone and package policies in 2021, the report says, with a 25 percent increase for stand-alone and a 21 percent increase for package. "This is a notable contrast to 2020, when we saw a single digit increase in stand-alone premium per policy and a reduction in package," the Aon report says.

Aon says that increase in overall premium per policy kept pace with the continued increase in cyber-loss severity. The average claim size increased 24 percent in 2021 to $91,833 from $74,354 in 2020, Aon reports. Severity increases were similar for both stand-alone cyber-insurance policies and package policies.

The severity increase in 2021 was lower than in 2020, when the size of the average claim increased 53 percent. Aon notes, however, that the cyber-loss severity increases of the past 2 years followed several years of declining severity, so the report urges caution in evaluating the trend.

Aon reports that the direction of cyber-loss frequency differed between stand-alone and package policies. While stand-alone frequency was down 9 percent in 2021, package frequency increased 14 percent during the year, the report says.

Aon offers some possible explanation for the difference in the frequency trend. One is that cyber insurers are pushing business from package to stand-alone coverage, leading to the total cyber-insurance policy count for stand-alone policies increasing 35 percent while declining 2 percent for package policies. "Because package has significantly lower frequencies than stand-alone, these changes in mix may lower stand-alone frequency while raising package if the larger package risks are moving to stand-alone," Aon says.

Another possible explanation for the increase in package frequency is that smaller companies might not be able to make the same cyber-security investments or understand cyber-security controls as well as larger businesses, Aon says.

The Aon report notes that cyber insurance is a catastrophe-exposed line of business. While there have been cyber-aggregation events, they haven't had a major impact on cyber insurers' performance and volatility.

In addition, the cyber insurers' 2021 results don't account for the Russia-Ukraine war, Aon says. "Insurers have contemplated enhanced war exclusions fit for the cyber peril as policies come up for renewal," the report says. "The insurance market hasn't seen aggregation events from the war yet and loss estimates so far are lower than expected but are subject to change."

The Aon report says that first-party coverage claims far outnumbered third-party claims in 2021, representing 75 percent of the total. The breakdown was similar for both stand-alone and package coverages, with first-party claims making up 74 percent of the stand-alone total and 75 percent of claims on package policies.

"This has been a consistent story since the first year the NAIC collected data: despite still commonly being labeled 'cyber liability,' cyber insurance is mainly a first-party product," the Aon report says.