istock-155389485_imagedepotpro-7
iStock.com / imadedepotpro
20 November 2019 Alternative Risk Transfer

Are we close to a billion-dollar cyber risk loss year?

Back in 2017, the notion of a billion-dollar cyber risk loss year was probably unthinkable. That was the worst year the affirmative cyber market had seen so far. Merck and Equifax put combined limits of $400 million to good use, and the NotPetya ransomware cyber attack showed via the property market that the year could have been worse if more of that limit had been shifted to the affirmative cyber sector.

With a few smaller initial losses, 2018 looked as though it would bring a reprieve, but the hacking of the Marriott International hotel chain and the subsequent data breach of the details of 500 million guests came at the end of the year to bring a big loss. That in turn was topped by a TSB cyber claim, in the wake of its April 2018 IT systems failure, that would later develop to more than $100 million.

Another development was the threat of a roughly $200 million cyber attack claim for British Airways, if fines and penalties wind up being covered in full. And in 2019 British Airways was hit by an outage that made markets look at waiting periods for such claims. Speculation now abounds as to how much of Capital One’s $400 million in limit is likely to be consumed by this year’s breach.

So it seems like a good time to ask: is a billion-dollar loss year coming? Specifically, will the cyber sector see a handful of large-risk losses (each at least $200 million, for the sake of discussion) crack into 10-figure territory?

Evolving opinions

Opinions in the Bermuda reinsurance market have evolved rapidly—almost to the point where ‘revolution’ is a more apt word than ‘evolution’. At the beginning of 2019, there was speculation that a single-risk affirmative cyber industry loss warranty (ILW) triggering at $200 million could sell, although the minority supporting this position shrank quickly.

Today, the prevailing view is that a similar instrument triggering at $300 million—50 per cent higher—is basically in the money from the start. One client referred to this sort of trade as a ‘sucker’s bet’. Subtle, right?

The prevailing view up and down Front Street is that you can count on a $300 million affirmative cyber loss in the global market every year. History may be a pretty good guide here. We came just shy of that level in 2017 (within 10 per cent) for a single-risk loss, and in 2018 we saw one.

This year has been quiet, with the initial PCS Global Cyber estimate on Capital One well below $300 million. However, it’s a big loss that’s hit a programme with plenty of cover. At a minimum, that makes it a warning. And in three years, we have one loss above $300 million, one close to it, and one significant loss that’s still in its early days. That’s certainly enough to get an underwriter’s attention, and some of the back-of-the-napkin pricing we’ve seen reflects that.

Aggregate protection seems more interesting than single-risk cyber ILWs at this point.

A few years ago, the large-risk cyber sector was fairly contained. It was pretty easy to list every company that had a couple of hundred million dollars in protection. And you could evaluate them thoroughly, make savvy named-company exclusions, and generally manage the transaction to a point where the price was palatable and the seller’s risk somewhat ring-fenced.

The changing landscape

Of course, now that the market is looking for affirmative cyber ILWs, the landscape is no longer as simple as it was in 2016 or 2017. We believe that there are more than 200 companies worldwide with at least $200 million in protection—and possibly significantly more insureds by now.

What does this mean? Well, it means you can count on at least one big loss, and there’s a bigger collection of companies that can provide it. Reinsurers need to prepare for the possibility of several big programmes being affected in the same year.

It may not be as ‘in the money’ as a single-risk $300 million ILW, but it’s likely to be relevant enough to warrant a double-digit rate on line (that’s worth paying). It also means that a billion-dollar year of large-risk losses may not be far away.

It’s easy to get close to $700 million (affirmative cyber) for 2018, depending on how a few issues in the market shake out. Even without the questions around whether the British Airways fines and penalties are covered, last year was still good for around half a billion dollars in losses.

As more companies begin to buy affirmative cyber—and as existing buyers continue to increase their limits—$1 billion only gets closer. Maybe, in a few years, the conversation will shift to a single affirmative cyber risk loss of that amount, but for now the industry is still trying to assemble a tower that high.

To get to that level—and frankly, to generally fuel continued growth in cyber—reinsurers will need to sort out a variety of risk transfer methods, and the ILW is chief among them. It’s better to know you can hedge before you need to pull the trigger.

Get all the latest re/insurance industry news with our daily newsletter -  sign up here.

​Africa Re lays the foundation of its new head office ​ Lloyd’s tackles unacceptable behaviour in the workplace ​ CAC Specialty establishes strategic relationship with Fortress Investment Group ​ Aviva unveils simplified operating divisions ​ Insurers unite to improve female financial futures ​ Sompo International appoints chief executive officer ​ Talanx on track to achieve the mid-term financial targets  ​ Marsh launches enhanced cyber risk quantification suite ​ Need for D&O insurance set to increase in China, Brazil and Canada

Don't miss our insurtech email newsletter - sign up today 

Already registered?

Login to your account

To request a FREE 2-week trial subscription, please signup.
NOTE - this can take up to 48hrs to be approved.

Two Weeks Free Trial

For multi-user price options, or to check if your company has an existing subscription that we can add you to for FREE, please email Elliot Field at efield@newtonmedia.co.uk or Adrian Tapping at atapping@newtonmedia.co.uk


More on this story

Alternative Risk Transfer
28 June 2019   Tom Johansmeyer of PCS, Verisk Insurance Solutions, considers five lessons the market will need to learn this summer.
Alternative Risk Transfer
20 October 2019   Loss creep remains a big issue for the insurance-linked securities (ILS) market, with some investors grappling with developments around the impact of 2017’s Hurricane Irma, which inflicted $77 billion in economic losses in the Northern Caribbean, Puerto Rico and Florida.