The cyber reinsurance market is growing beyond just growth-supportive quota share reinsurance and pricey, thus underutilised, stop-loss agreements. You’ve heard a lot about cyber insurance-linked securities (ILS) as an emerging risk transfer tool but, some claim, its real role may be to set up a bigger growth story: cyber cat event excess of loss (XoL).
That is the perspective of Dan Carr, head of cyber underwriting at Ariel Re and creator of CyberShock, a cyber catastrophe consortium formed in partnership with Hiscox Re & ILS, which is designed to offer up to $50 million of per-programme capacity, providing tailored, event-based protection for cyber insurers worldwide.
“We are very comfortable providing catastrophe-based structures; it’s in our DNA,” Carr said. “We now see buyers taking less quota share and taking more risk net.”
That is not to say this will revolutionise a still-untested market. “This doesn’t mean any seismic pivots,” he said. Instead, it is an evolution. Carr makes reference to an unspecified major carrier that has completed a full pivot away from quota share, but most cedants talk about adding cyber cat XoL gradually to shift the balance of cover, he said.
“We are not at the tipping point, but we are closer in light of recent market loss events and an increased focus on systemic loss uncertainty,” Carr said.
How it will develop
The timing may be relevant. Carr cites 2022 when ransomware was the driver of huge market growth almost exclusively on rate hikes. But it also “brought out all of the scary questions”, Carr said of early cyber cat thinking.
“If we have X billion in premium, how much do we have in limit? What does the worst day at the office represent?
“To date, we have had an insurance market focused on penetration and pricing. It has not necessarily considered what the tail might look like, until it reaches some level of critical mass relative to other classes of business.”
Direct carriers may have felt safe expanding their portfolio if they could cede 50 to 70 percent of risk in exchange for adequate commission. Conversely, reinsurers may have been pleased with the ease and efficiency of assuming risk without going into the nitty-gritty required for XoL offers at scale.
Carr suggests reinsurers will start to feel capital strain in line with the fast-growing proportional market. He suggests ratings agencies may consider asking reinsurers to hold capital in line with model results. “If that were to come to pass, the market complexion changes fast.”
Direct carriers, for their part, might feel they’ve outgrown the early stages of market development where quota share support is all that is needed. Now, they may want security on top. Savvy players in primary cyber may have the confidence to retain more first-dollar premium.
Right product, right time?
Meanwhile, the cyber ILS market is developing. After a number of small deals in 2023, more followed in 2024. These are a predecessor and proof of concept, not competitor, to the cyber XoL that is yet to establish its proper place, Carr argued.
“ILS can embed catastrophe structures and concepts in the market.”
“Now that these deals have been done, there can be an assessment if it’s the right product at the right price,” he said. ILS could gravitate to larger deals in very remote layers, he suggests.
“More importantly, ILS can embed catastrophe structures and concepts in the market,” Carr added. Comfort with the models and/or with the event definitions can open further doors.
Carr believes the market will develop event definitions and parameters for deals that can work even as the risk landscape changes, sidestepping the market’s tendency to tack the latest threat on to an ever-growing list.
“We want one consistent product, not a mass of product and conceptual variation,” Carr said. “If it keeps changing, it will never take off.”
For that trajectory, Carr’s story has a strong element of right-person, right-place, right-time to it. He is a former cyber defence expert turned primary underwriter with a tie to ILS, writing for a reinsurer with a heavy appetite for cat. And at a time when clients want to look beyond quota share as the only risk transfer option for cyber.
Carr’s backstory includes that he was a cybersecurity consultant with the Ministry of Defence and then BAE Systems. That was followed by underwriting for cyber-focused MGA Occam Underwriting owned by an ILS fund, hitting the crossroads where primary coverage meets reinsurance. He moved to Ariel Re in late 2021.
