There is constant chatter about cyber insurance and reinsurance as a meaningful future component peril of the insurance-linked securities (ILS) asset class, but so far little transactional flow has been seen. We spoke with Tom Johansmeyer, Head of PCS, to get his view on the current status of cyber ILS.
Q: You’re in regular contact with cyber underwriters and brokers. How did the renewals go at 1/1 in that class of business?
TJ: I guess it depends who you ask. The optimist would say that plenty of capacity was deployed at reasonable pricing, which is what you’d hope for. A realist would tell you that most major programs didn’t get all the capacity they were looking for. A pessimist would tell you that the whole process is going to get even harder.
Q: Which of those three are you?
TJ: I guess I feel a bit of all three. But I’d add that we all saw this coming and didn’t do much to prepare for it.
A couple of years ago, I suggested that we could see a lossless capacity crunch fuelled by rapid growth in the primary market, with the flow of capital down the risk-transfer chain hampered by a reliance on traditional reinsurance methods (particularly quota shares) and a lack of access to a robust and reliable retro market. I would have preferred to be wrong about this one, frankly.
Q: How did we get to this point?
TJ: The good news is that we’ve arrived at a cyber product that seems to be useful to original insureds. That’s a massive step forward for our industry.
I remember moderating a panel at Artemis’ NYC conference a few years ago and asked our guests whether they felt the cyber coverage that existed at the time was designed with clients in mind. Every one of the panelists laughed.
Not today. In fact, we’ve seen the market tested with several significant affirmative cyber risk losses of around US$100 million and up.
Cyber insurers have done their job well. I don’t think we reflect on that enough. The sector has evolved because the people who make up the sector have driven that evolution. They deserve a lot of credit.
Of course, the maturation of the sector—and demonstrated effectiveness of the product—have led to increased demand.
PCS estimates that there are roughly 250 companies with at least US$200 million in affirmative cyber insurance protection. We believe there are around 40 companies with at least US$500 million. Efforts to push that ceiling higher are ongoing.
Q: It takes capital to push the ceiling higher…
TJ: Exactly. A few years ago, it wasn’t unusual to hear a reinsurance broker tell you, “I can place just about anything.” Then it became, “I can place just about anything, as long as…” with the statement pretty heavily caveated.
Now, there are capacity shortages in cyber, the risk of pricing inverting after a certain point, and concerns about information asymmetry.
Cyber has become a real line of business.
Four or five years ago, risk management among insurers often consisted of “not betting more than you can afford to lose.” Those days are long gone. Insurers have become more sophisticated. Reinsurers as well. But we’ve hit a wall in the evolution of the sector. Risk-transfer sophistication hasn’t kept pace with the needs of the market.
Q: Can you explain that a bit more?
TJ: Original insureds aren’t getting all the protection they want or need. Insurers haven’t been able to secure all the reinsurance they require. Reinsurers have access to a thin retro market at best.
Okay, common sense would suggest that we need to build out the retro market. Yet, I regularly get questions about driving ILS [insurance-linked securities] capacity into the original insurance market! There may be some limited cases where that could work, but you can’t build a market off it.
Q: As the rates on line just wouldn’t be there for ILS funds, in primary cyber?
TJ: Correct. An ILS fund would need rates quite a bit higher than what you see in the large affirmative cyber programs right now, particularly as you go up the tower. It’s a function of using collateralized markets.
Ultimately, there’s a mismatch between the buyer and capital in this scenario.
Q: Is there a role for ILS then and where is it?
TJ: Absolutely. When you really look at the cyber re/insurance market, you can ultimately trace the sector’s capacity crunch to the lack of retro available.
When you look at the top three to five cyber reinsurers in the market, they can’t really seek retro from each other (not with any scale) because they’re on a lot of the same risks. A systemic event would be brutal.
Outside the biggest writers, you might be able to piece some retro protection together, but it’s hard to arrive at the big numbers a retro buyer would need, particularly given the concentration of risks involved.
You really need an external source of capital that truly transfers the risk out of the global re/insurance market.
Q: That sounds familiar…
TJ: Yup, it’s what everyone was saying about ILS back in 2008 and 2009.
Protection from systemic events would come in part from transferring risk outside the global re/insurance system to the capital markets, which could absorb major re/insurance sector shock losses. It applies to cyber as well.
Q: So, what’s standing in the way?
TJ: Three years ago, I’d have said unwillingness to change and inexperience. Now, I’d say it’s digesting three years of cat losses.
We were seeing interest in cyber grow steadily in the ILS sector through the summer of 2017. Then, Hurricane Harvey hit. Then Irma. Then Maria. Then the wildfires. And in 2018, we saw major losses in the United States and Japan, followed by major losses in Japan, Chile, and Australia in 2019.
The sustained cat activity from the past few years has affected ILS capital and operations, which has made expanding into emerging classes of business challenging.
Over the past couple months, though, I’ve had more people come to me to discuss cyber in the ILS space, which shows that we should be getting that early-2017 momentum back.
Maybe 2020 will be the year of the cyber ILW [industry loss warranty].
Q: You’ve been saying that for a few years now.
TJ: It’s true; I’ve been pretty committed to that prediction. I genuinely believe that it will come true someday. All joking aside, interest from the ILS sector has spiked, and conversations have gone from high-level to drilling into losses, exposures, market dynamics, and other mechanical factors that would help someone understand—and transact in—the global cyber reinsurance market.
Several folks are taking serious looks at pricing and modeling, and the first test buy could already be in the works!
Q: So, what’s changed? What makes the timing right for a cyber ILW now?
TJ: First, the capacity shortage is a major factor.
ILWs are an easier way for ILS funds to deploy capital to a relatively new class of business. And with a fairly limited universe of large risks, the analytical effort should be manageable.
Further, the ILW structure does make sense here. It’s an easy and efficient way to hedge large risk losses in a new and changing market.
Finally, the market is starting to realize that the capacity crunch from this past renewal isn’t going to alleviate itself. In fact, it would probably be made worse by a significant loss year.
The need for retro is only part of the challenge. The other is that the market needs to be primed. It makes more sense to buy an ILW now and complete the process without pressure than to wait until losses harden the market.
Accessing large amounts of ILS capacity post-loss would be difficult and costly.
Simply put, it’s better to put on the helmet before you crash—not after.