Newsletters
Risk Central
Digital EditionCyber Insurers Face Systemic Risk with Concentration in SME Policyholders
AM Best’s inaugural survey of global cyber insurance companies, encompassing 41 insurers representing $7.9 billion in premiums, sheds light on critical trends shaping the industry, including the development of catastrophe modeling, shifting exposure patterns, and emerging claims data for cyber.
As the cyber insurance market evolves, risk modeling by cyber insurers is still in its “nascent stages,” the survey found.
Of the 41 cyber insurers surveyed, 30 reported using some form of catastrophe modeling. Breaking down the types of models used, 10 companies rely solely on probabilistic models, while five use only deterministic models. AM Best noted that 15 insurers have opted for a hybrid approach, utilizing both probabilistic and deterministic models in their risk assessment strategies.
“AM Best is agnostic to the cyber model used – whether it be internally developed or an external one. We look for management’s understanding of the risk and the ownership of risk models in terms of assumptions and parameters,” the report stated.
Market Exposure Patterns and Systemic Risk
The cyber insurance landscape is predominantly shaped by small businesses, with the majority of insurance limits covering entities that generate less than $10 million in annual revenue.
This segment represents 73.1% of all cyber policies, and 21.3% of direct premiums written. The next largest group, businesses with $10 million to $250 million in revenues, account for 16.1% of policies and 23.9% of premiums.
The concentration of small businesses in the cyber insurance market raises potential systemic risk concerns, according to AM Best.
“To the extent that any of these small businesses could be using the same cloud service or another common service illustrates how one outage or attack could impact several policies,” said Christopher Graham, senior industry research analyst, AM Best.
This interconnectedness underscores the importance of robust risk assessment and management strategies for cyber insurance providers. As the cyber landscape evolves, insurers must remain vigilant in evaluating the potential for cascading failures across their policyholder base.
While small businesses dominate in policy numbers, large enterprises with more than $1 billion in annual revenues represent a significant portion of the cyber insurance market’s premium volume. These organizations, often primary targets for sophisticated cyber attacks due to their vast customer data and financial resources, account for 29.2% of total cyber premiums despite comprising 1.7% of policies.
The substantial premium contribution from large enterprises reflects the higher risk profile and more comprehensive coverage needs of these organizations. Insurers must carefully balance their portfolio between the high-volume, lower-risk small business segment and the high-value, higher-risk large enterprise segment to maintain a sustainable and profitable cyber insurance business, according to AM Best.
Claims Trends and Risk Mitigation
In the current cyber insurance market, the majority of claims paid (57.2%) are still classified under an “unknown” coverage type. This classification challenge reflects the complex and often ambiguous nature of cyber incidents.
However, among specifically categorized claims, “incident response” represents 22.5% of claims paid, which is more than half of all reported cases. Other classifications account for a much smaller share of cases. For example, after incident response, the next largest classification was extortion, accounting for 3.9% of claims, and financial theft/fraud, accounting for 3.6%.
Ransomware has emerged as the most common claim type in the cyber insurance sphere. These attacks, characterized by their quick payouts to threat actors, pose a significant risk to businesses of all sizes.
“While many insureds have been able to avoid paying ransom, those that haven’t ultimately may endure more losses owing to business interruption than the cost of the ransom,” said Bryan Raber, associate analyst, AM Best. “On a per-claim basis, business interruption claims are more expensive than incident response claims.”
For example, while business interruption accounted for only 1.2% of cyber claims paid, it accounted for 25.3% of net incurred losses. Incident response claims, by contrast, accounted for 14.4% of net incurred losses.
As cyber threats continue to evolve, AM Best emphasized the importance of robust backup systems and cyber hygiene measures, such as prompt software pathing, to manage the risk and make businesses more resilient.
Access the AM Best cyber commentary here. &
