The State of the Cyber Market

This article reflects the perspective of Jens Houen Zakarias, Head of Cyber at RiskPoint. Having worked with cyber insurance since 2014 and as one of RiskPoint's first cyber underwriters since 2018, he has followed the development of the European cyber insurance market through both hard and soft market cycles.

The Continental European Perspective on the Cyber Market

A Decade of Volatility in Cyber Insurance

The cyber insurance market has experienced rapid and volatile evolvement over the past ten years. In 2016 cyber insurance was still a young, innovative, and profitable product that many insurers and MGAs saw as a large opportunity for growth and an expansion of their insurance offering.

By 2019, after several years of a broad cyber underwriting appetite, the wave of ransomware hit companies across the globe leaving many cyber insurance providers with severe losses on their books. Market penetration was still limited and thus many had yet to build proper portfolio volume that could sustain the losses. A new market paradigm took shape, characterized by the withdrawal of capacity, narrowing coverage, pricing increases and heightened underwriting scrutiny.

While this period of correction took the cyber insurance market back to profitability, it also went on for too long. Basic principles of supply and demand led to excessive price increases. The volatile product had turned into a cash cow. Unsurprisingly this attracted an influx of new capacity providers and encouraged historic capacity providers to return to the marketplace, and since 2022 the marketplace has become increasingly competitive. Rates have continued to freefall, coverage is expanding every month and underwriting criteria is becoming less stringent.

From Hard Market to Renewed Competition

Within the cyber insurance world, there is a lively debate around "when the market will turn hard again". There are many opinions. We don't have a crystal ball at RiskPoint, but we have made our considerations and our view is the boring old phrase: "It depends". RiskPoint has been writing cyber insurance exclusively in continental Europe since 2017. Consequently, our market observations are based on our experience in the European cyber insurance market and reflect that regional perspective.

The Pressure on Underwriting Discipline

Declining rates and less underwriting information means that underwriters are expected to maintain premium levels whilst having less and less time to do their assessment. This means that there is a heavy focus on efficiency gains through automation and portfolio underwriting. Portfolio underwriting in a competitive marketplace tends to commoditize the offering. Broad, one-size-fits-all coverage, with limited and standardized question sets, is becoming the norm even for sizeable companies. Commoditized offerings effectively mean that many buyers do not receive pricing that is commensurate with their exposure, but rather with a rate that averages out across varying exposures.

Where is the Pricing Floor?

With rates in Europe continuing to drop, the question we are all trying to answer is "Where is the floor?". Back to the crystal ball. We still don't have one, but we do have an opinion. We are still confident that competitive pricing can be sustained for the right risks.

The Uncertainty Load Has Disappeared

That statement comes with a caveat that we continue to monitor. The 'uncertainty load' for cyber has all but been eroded from the pricing. Cyber is an ever-evolving exposure shaped by ongoing regulatory developments, geopolitical tensions and a constantly changing threat landscape with emerging attack vectors and refined adversary tactics. AI is an example that has the potential to dramatically alter our view of cyber exposure, although this is yet to materialize in performance. Cyber pricing models are, similar to most insurance lines, based on historical performance and trending of future losses. Where cyber differs is an increased level of unpredictability. We cannot underwrite to unknown exposures of the future. In the current market environment, underwriters cannot price for that uncertainty. This leaves the market susceptible to a sharp turn should the exposure dramatically change; exactly as we experienced with the surge of ransomware in 2019-2020.

Conclusion: A Competitive but Vulnerable Market

To conclude, if the claims environment remains as stable as we have experienced over the past two to three years, we believe that the right risks will continue to secure competitive terms, and market stabilization will be slow. However, the market is in a vulnerable state and should underlying exposures deteriorate beyond traditional modelling, we believe there is limited fat left in the current rates.