Steering Through a Transitioning Cyber Insurance Market
The cyber insurance market is undergoing a significant shift. While cyber threats continue to evolve, insurance rates have been in a downward trend, and competition among insurers has intensified. This transition is certainly creating opportunities for businesses seeking cyber coverage, sometimes for the very first time. However, it also raises questions about the sustainability of pricing and the long-term outlook of the cyber insurance market.
Despite continued cyber threats, several factors are contributing to lower premiums. Many insurers are now offering cyber policies, increasing market capacity and leading to more competitive pricing. Established players are expanding their offerings, and new entrants are looking to capture market share through very competitive pricing.
We’ve all learned a lot
Businesses have become more proactive in managing cyber risks and that’s certainly good news. Investments in cybersecurity infrastructure, employee training, and compliance frameworks have led to lower claim frequency and severity, which insurers are factoring into their pricing models.
Insurers have refined their underwriting models, using more sophisticated risk assessments. Companies with strong cybersecurity postures are rewarded with better rates, creating an incentive for businesses to invest in security measures.
While ransomware attacks remain a significant concern, some insurers are seeing fewer large-scale claims. Law enforcement efforts, better backup solutions, and increased awareness of cybercrime schemes, like phishing tactics, have helped reduce losses in some cases.
Death by a thousand paper cuts
Yet, the cyber-attacks still keep coming.
The increasing frequency and severity of cyberattacks—ransomware, data breaches, and business email compromise—have forced insurers to reassess their risk models. However, it is not just the high-profile incidents that pose a risk; rather, it’s the multitude of smaller events—such as minor data breaches or phishing attempts—that can accumulate, leading to significant cumulative losses. It calls to mind the idiom: “Death by a thousand paper cuts.”
Each incident may seem manageable in isolation, but together they can overwhelm a business’s defenses and create a ripple effect of claims that insurers must address.
We’ve lived through some very high-profile incidents in just the past year. None proved to be a market-changing event or something we might call a “cyber hurricane.” Past hurricanes like Andrew and Katrina sparked some big changes in the property insurance market.
In the cyber market, we’ve seen what’s been referred to as “Kitty Cats.” While each individual incident has been significant, they have been manageable for most. Collectively though, they have the potential to lead to substantial negative consequences for cyber insurers and their long-term market commitment, especially as we see more and more of these incidents.
Managing through the market cycle
The current trends in the cyber insurance market share several similarities with historical patterns observed in other market segments, like property & casualty. Historically, both market segments have seen their fair share of hard and soft market conditions.
In terms of pricing dynamics, the casualty market adjusts premiums reactively based on claims experience, where a rise in litigation or severe claims prompts insurers to raise prices.
In the cyber insurance sector, premiums surged significantly between 2020 and 2022 in response to escalating ransomware attacks and data breaches, but the current trend indicates a decline in rates due to increased market capacity and competitive pressures. This rapid pricing adjustment reflects a more volatile environment even compared to the casualty market’s historical patterns.
When examining claims frequency and severity, the casualty market has dealt with predictable claims patterns based on historical data, while the cyber insurance sector is dealing with both rapidly evolving frequency and severity of claims. As the casualty market has adapted to new types of risks, such as distracted driving and changes in workplace safety regulations, the cyber insurance market is similarly influenced by regulatory changes, particularly those concerning data protection and privacy.
While the cyber insurance market reflects dynamics that echo those of the historical casualty insurance market, the unique and rapidly evolving nature of cyber risk presents distinct challenges that require the insurance industry to remain agile and responsive, but also to pay close attention to underwriting discipline and the aggregation of cyber risks.
Insurers can and often do exit markets under challenging conditions, such as high loss ratios, increased competition, and evolving regulatory pressures. By maintaining underwriting discipline and closely watching risk aggregation, cyber insurers can better manage their exposure, ensure sustainable operations, and most importantly, provide reliable coverage for their clients, for the long term.
What businesses should do now
With the current competitive market, businesses have an ample opportunity to secure affordable cyber insurance coverage. However, to assure that they are getting the right cyber coverage and are well prepared for price fluctuations, they should take a strategic approach:
- Compare multiple providers: In a competitive market, businesses should compare quotes from various insurers to secure the best mix of price, coverage, underwriting, and claims experience. Longevity in the cyber market is crucial, as cheaper options may lack the financial stability to pay future claims. Additionally, prioritize claims-paying experience; established carriers handle complex claims efficiently for quicker payouts. In large insurance towers, more experienced lower-tier carriers facilitate faster claims processes, while less experienced layers can complicate and delay them.
- Continue to invest in cybersecurity: Maintaining strong security measures can help businesses qualify for lower premiums and broader coverage, particularly in mitigating the risk of smaller cumulative incidents.
- Understand policy terms: Companies should carefully review coverage limits, exclusions, and response services to avoid gaps in protection.
- Take advantage of your insurer’s proactive cyber security services: To help clients actively manage cyber exposures, many insurance markets, AXA XL included, offer proactive cyber risk management services including risk assessments, threat intelligence, vulnerability management, and security awareness training to identify and mitigate potential cyber threats before they escalate.
- Work with your broker: An experienced broker can help navigate the evolving market and find policies tailored to specific needs. Brokers can also provide valuable insights into policy terms, help businesses understand exclusions, and assist in claims processes.
It’s a pivotal moment
The cyber insurance market is at a pivotal moment. If loss ratios remain stable and underwriting remains disciplined, rates could continue to be competitive, fostering an environment where businesses feel empowered to secure comprehensive coverage. However, as we observe market cycles, it’s essential to recognize that economic conditions can affect risk perception and pricing structures.
Insurers are watching the potential impact of cumulative claims that can arise from seemingly minor cyber incidents. If cyberattacks escalate in severity and frequency—particularly through the accumulation of minor incidents—insurers may have to adjust pricing again.
Ultimately, businesses should not only focus on capitalizing on current market conditions but also prepare for potential fluctuations. By investing in risk management strategies and fostering a culture of cybersecurity awareness, organizations can better position themselves to navigate the complexities of the cyber insurance market as it responds to changing economic and risk environments. &