Cyber ILS & retro needed to improve market capacity: S&P

The development of a robust cyber retrocessional reinsurance market and the use of insurance-linked securities (ILS) or alternative capital, would help the cyber insurance market with its capital management and make much-needed capacity available, according to S&P Global Ratings.

S&P believes that the cyber insurance market needs more support and capacity, to enable coverage to be more broadly available and the market to operate in a more sustainable manner.

“Demand for cyber re/insurance coverage has increased significantly,” S&P explained in a new report, which is mainly because of a heightened awareness of cyber risks.

The pandemic has also had an effect, as it “reordered the cyber risk landscape” S&P said, which resulted in economic and insured losses from cyber skyrocketing far higher.

“The trend toward digitalization will inevitably lead to a higher likelihood of cyber incidents. Prices in the cyber re/insurance market could therefore rise sharply over 2021-2023, even doubling in some cases,” explained S&P Global Ratings credit analyst Manuel Adam.

“We estimate that primary insurers pass 35%-45% of global cyber premium to reinsurers and rely on them for their expertise in managing potential accumulation risk and exposure to cyber risk. The pandemic exacerbated the huge cyber reinsurance protection gap by causing existing and new clients to request larger limits and more inclusions in their policies’ terms and conditions.

“Partnership between reinsurers and primary insurers could strengthen coverage, give greater balance sheet protection against frequent, high-severity losses, and support access to cyber-related services.”

Currently, with primary cyber insurers relying on reinsurance capital, but reinsurers limiting their exposure to the space and tightening down terms, while there is also insufficient retrocessional capacity to support the reinsurers, the market faces a quandary in terms of how to fund sustainable growth.

With cyber claims also on the rise and the cyber threat landscape expanding, it’s always been seen as inevitable that an element of capital market funding would be required to support the capital needs of the cyber insurance market.

Rates have been rising in the primary cyber insurance market, but S&P does not believe that these are moving fast enough to offset increases in the average combined ratio of the market’s underwriting.

That implies more rate increases will be required, but also that further changes in the structure of cyber underwriting businesses and where their reinsurance attaches will be needed.

But to achieve that, the reinsurance capacity needs to be available and affordable as well.

“Reinsurers’ expertise in underwriting and modeling could help to build up the market. In our view, if cyber insurance is to meet the needs of customers in the future, it is more important than ever that the industry focus on risk differentiation, strong underwriting, and assistance services,” S&P’s report explains.

Global Ratings credit analyst Manuel Adam added, “A more mature retrocession and insurance-linked securitization market could increase capacity and support cyber market growth and could lead to better returns on capital because of efficient capital management further down the re/insurance chain.”

S&P’s report continues to explain, “In our opinion, lack of capacity could be holding back the development of a sustainable cyber re/insurance market.

“There is a significant demand for cyber coverage and we expect this business line to be one of the fastest growing insurance markets over the next decade. The dynamic change in claims pattern, rise of cyber threats, and huge accumulation risk creates an opportunity for larger reinsurance capacity. The number of reinsurers and insurers offering cyber coverage is rising in response.

“But with such a new segment, we think it is important for reinsurers to offer primary insurers support in managing the underwriting and risk management processes for cyber, as they do for natural catastrophe exposures.”

Reinsurers are considered well-placed to help support cyber insurers and to grow the market, but S&P warns that they too need to “cope with structural challenges and systemic risks, the increase in cyber attacks, and an accumulation of exposures.”

Otherwise the build up of non-affirmative, or so-called silent cyber, exposures could increase in the reinsurance market, which suggests that reinsurers need a robust retrocession market to help them spread risk and protect their books.

Which is likely one area that the insurance-linked securities (ILS) market could come in, as a retrocessional reinsurance capacity provider to the major cyber reinsurers.

But the other area where capacity is seen as severely lacking, is in cyber excess-of-loss reinsurance, where limits available are estimated to be as low as $2 billion per annum.

In addition, the facultative cyber market is also seen as falling short on the capacity required.

On the retrocession side, as most of the reinsurers involved in cyber are already writing proportional business, they are nervous about adding retro exposure, for fear of aggregation and accumulation risk.

In addition, reinsurers hesitate to share their cyber underwriting and claims data with retrocessionaires, who are also seen as potential competitors on the reinsurance side.

“This has hindered the industry’s ability to establish a comprehensive retrocession market. We have seen a bottlenecking effect down the value chain leading to reinsurance and primary insurers,” S&P said.

Adding, “In our view, a sound and reliable retrocession market would promote the development of a robust cyber re/insurance market. A more mature retrocession market could also enable reinsurers and primary insurers to manage capital more effectively, which could lead to stronger returns on capital.”

As a result, it is natural to turn to alternative capital and ILS funds, which have in the past filled gaps in reinsurance and retro capacity availability for peak perils.

S&P explains the logic behind this, “The cyber market has limited capacity at every level–primary, reinsurance, and retro. Anywhere we see a lack of capacity, especially in a market which has enormous potential for economic losses, we believe that with risk-adequate pricing re/insurers have an opportunity to partner with the capital markets and so increase capacity.”

S&P notes the development of ILS within catastrophe risk, as it now takes risk and provides capital to the primary, reinsurance and retrocession layers of that market, saying that it is possible ILS and alternative capital can do the same in cyber risks.

However, the development of a cyber ILS market has been slow, for all the usual reasons of a lack of data, models the inherent uncertainty related to silent cyber, the potential for financial market correlation and also the fact prices are often deemed inadequate by ILS funds.

On top of this the structure of cyber reinsurance an retro has not been designed with ILS investors in mind, S&P said, but this is showing more positive signals of becoming more palatable to the ILS market these days.

“The cyber market’s initial focus was on capacity in proportional reinsurance, instead of excess-of-loss reinsurance structures, which ILS investors prefer. The few excess-of-loss contracts written were on a risk-attaching basis. This is not attractive to investors as their exposure is not confined to the period of the contract, and could last multiple years. The recent move to claims-made structures, which shorten the tail of the exposure to a year, could make cyber insurance more interesting to ILS investors,” the report states.

While it’s clear that the cyber market needs capacity support and as a result there could be a clear role for the ILS market in providing some of this, it’s not as clear-cut due to the correlation that is inherent in some cyber exposures.

“Capital market investors may still prefer to invest in natural catastrophe risk because it is less correlated to market risks. This gives them a clearer diversification profile and shorter tail. By contrast, a big cyber event could trigger a decline in stock and bond market values, increasing the correlation with capital markets,” S&P warns.

Further cyber rate increases and the increasing availability of shorter-tailed cyber reinsurance products could help, but the correlation with global financial markets may be harder to overcome for many ILS investors and ILS funds whose mandates are largely focused on cat risks.

As a result, the ILS market may be advised to focus on affirmative cyber risks, S&P believes, with industry loss warranty (ILW) products that have a cyber industry loss index trigger seen as a potential avenue for the capital markets to enter the space more meaningfully.

That could provide much-needed retrocessional capital support to the reinsurers, allowing them to write more cyber business on the front-end.

Don’t expect a big rush of capital into cyber risks though, as S&P notes that this is likely to be a relatively slow sector for the ILS market to get engaged in.

“Given the relative infancy of the cyber re/insurance and retrocession market, we anticipate that it will take some time before the capital markets are ready to take on a bigger share of the risk. Investors typically rely heavily on historical claims data and risk modeling when taking on insurance underwriting risks,” S&P said.