Growth in the Cyber Insurance Market Has Stalled: Here’s Why This May Be Good for Your Business

Listen to the audio version:

A recently released report from S&P Global indicates that the exponential growth of the cyber insurance product over the last few years has started to level off.

Overall, direct written premiums fell slightly in 2023, dropping 0.7% from the prior year but still amounting to over $7 billion. Standalone policies registered a 3.2% decline, while the smaller market for package policies grew by 5.1%. S&P Global also noted that amidst stabilizing prices, direct loss ratios (which measure carrier payouts on claims relative to premiums) increased slightly, from 43.1% to 43.6%, but these figures are still well below the results the industry saw in 2020 and 2021, when loss ratios were around the 70% mark. This is significant because underwriters need to keep loss ratios under 60-65% to continue to offer this coverage profitably. Even more telling is the performance of individual carriers. Eight of the top ten insurers for standalone cyber had loss ratios under 60%, and nine of the top ten were under 65%. The one insurer with a less profitable loss ratio has been shrinking their book year over year.

S&P is also reporting that insurers do not expect to see large losses from the attack on Change Healthcare, an incident which has affected 189,000 entities, according to the risk analytics firm CyberCube. However, this attack did underscore the vulnerability posed by third party risk, and more specifically, the service providers that cater to a large swath of a particular industry, such as healthcare. As CFC Underwriting acknowledged in its comments on the report from S&P Global, underwriters are still grappling with how to address the exposure presented by many businesses in a sector using the same handful of vendors, a danger known as “risk aggregation.”

The Takeaway: Managing third party cyber exposures is critical, both in terms of presenting a compelling story to the underwriters as well as reducing the likelihood and potential impact of an attack. Vendor management includes thoughtful contract wording, independent audits of service providers and the development of contingency plans for an outage at a key service provider. The stabilizing market also provides an opportunity to ensure that coverage remains fit for purpose. With so much emphasis on pricing over the past few years, broadening coverage wasn’t always possible. Now, underwriters may be open to considering coverage enhancements that they were unwilling to entertain during previous renewals.