How does reinsurance affect the Cyber insurance market for buyers?

Has your broker ever told you that the change in your renewal terms are due to market conditions? Well, Nikhil Desai, Associate Director in our Cyber Retail team sat down with Toby Lampier, Director in our Cyber Reinsurance team to discuss how reinsurance might impact your cyber insurance quotation. 

Toby, thanks for joining us. We’re going to start off with the basics here, what is reinsurance?

It is an arrangement whereby an insurer transfers all or part of a risk to a reinsurer to provide protection against the risk of the first insurance. Reinsurance is purchased for a variety of reasons such as expanding available capacity so they can write more business, stabilise underwriting results, financing, protecting against catastrophe / systemic risk, spreading risk and acquiring expertise.

We often see various products in the insurance market, is this the same for reinsurance?

Yes, the Cyber reinsurance market is currently dominated by three different types of reinsurance products, of which the preferred option is dependant on risk appetite of the buyer:

1. Quota share  -  Quota share reinsurance is a type of reinsurance agreement in which the reinsurer agrees to assume a predetermined percentage of every insurance policy that the primary insurer underwrites. In other words, the primary insurer cedes a fixed portion of its risks and premiums to the reinsurer in exchange for a share of the premium income and liability.
2. Aggregate stop loss - Aggregate stop-loss reinsurance is a type of reinsurance agreement that protects the primary insurer against an accumulation of losses exceeding a predetermined threshold over a specified period, typically a policy year. It provides coverage for losses that exceed a certain aggregate amount, rather than covering each individual loss.  
3. Event excess of loss - Event excess of loss reinsurance is a type of reinsurance agreement that provides coverage to the primary insurer for losses resulting from a single catastrophic event, such as a natural disaster or a large-scale man-made event such as a Cyber-attack. Unlike aggregate stop-loss reinsurance, which covers the accumulation of losses over a specified period, event excess of loss reinsurance focuses on single, widespread, high-severity events.

So what is it that Howden Re do within the reinsurance marketplace and what’s your role within the team?

The Cyber reinsurance team at Howden Re acts as an intermediary between insurance companies seeking to transfer risk (cedents) and reinsurance companies willing to assume that risk. Our primary role is to facilitate reinsurance transactions by connecting cedents with reinsurers, negotiating terms and pricing, and providing expertise and guidance throughout the process. We do this for a range of cedents throughout the globe who have portfolios of Cyber insurance risk and help these cedents to effectively manage their exposure.

Alongside the transaction, the Howden Re cyber reinsurance team also provides in-depth analytics for cedents which includes but is not limited to underwriting consultancy, business planning, pricing & exposure management, peer benchmarking, portfolio modelling, scenario design, threat intelligence insight, claims analysis and development.

Would we assume then that an insurer’s result on their reinsurance purchase might impact the cyber market?

Reinsurance plays an important role in the Cyber market by helping insurers manage their risk exposure and capacity, thereby enhancing the stability of the market. Insurers are able to manage their capital more efficiently by reducing their systemic / catastrophe risk exposure and managing the volatility in their attritional performance, this will then feed into insurers pricing and appetite for direct Cyber business. Reinsurance also has a key part in driving innovation in the Cyber market through helping to develop new products, enhancing coverage and tailoring solutions to emerging Cyber threats and client needs.

You talk about insurers managing their risk exposure and whilst this enhances stability, are there any times that a reinsurer might apply restrictions, limiting what an insurer can do and consequently affecting end buyers of cyber insurance?

Typically, reinsurer’s philosophy is light touch and to “follow the fortunes” of the insurer they are supporting. Where we have seen examples of restrictions being applied, these are focused around managing systemic risk as this is the main solvency challenge to a reinsurer. Therefore, in theory, one avenue where reinsurers are able to exert influence over a direct buyer is through contractual restrictions and guidelines imposed upon their insurer’s reinsurance purchases. This will impact a direct buyer as terms and conditions imposed in the reinsurance space can be replicated in direct business as insurers do not want to carry more net exposure than they had planned for. We have seen some examples of this recently with certain reinsurers imposing war exclusions and critical infrastructure failure exclusions, to name a few.

You touched upon systemic risk, which has been brought up quite a lot in the past few years in particular and we have seen some insurers apply restrictions surrounding this. What is systemic risk and why are reinsurers concerned by this?

Systemic or catastrophic risk refers to the potential for events or situations that could cause widespread and severe damage to an entire system, industry, or economy. These risks typically involve events that are rare but have the potential to have significant and far-reaching impacts. Examples include natural disasters like earthquakes, hurricanes, or pandemics, as well as financial crises or geopolitical conflicts and more recently, widespread Cyber attacks or outages.

Reinsurers are concerned about systemic or catastrophic risks because they often bear a significant portion of the financial burden associated with such events. Reinsurance companies provide insurance to primary insurers to help them manage their risk exposure. When a large-scale event occurs, reinsurers may be required to pay out substantial claims to primary insurers, who in turn pay claims to policyholders. The concern for reinsurers arises from the potential for these events to result in massive losses that could exceed their capacity to pay claims.

Other than systemic risk, what are we seeing on the horizon that may impact the cyber insurance market?

The Cyber reinsurance market is in a healthy place to support the future growth of the Cyber market. Following a correction to the Cyber insurance market between late 2021 to mid-2023 as a reaction to the increase in frequency and severity of ransomware, there has been an influx of capacity to the Cyber reinsurance market from both rated and alternative capital. There is appetite among rated Cyber reinsurers to grow across traditional reinsurance products, such as quota share, aggregate stop loss and event excess of loss and we saw the first 144a Cyber Cat Bonds* being traded in 2023 which brought a significant amount of new capacity to the market.

The Cyber reinsurance market is dominated by 10 reinsurers who make up over 80% of the capacity and while the alternative capital attracted to the Cyber reinsurance market is still in its infancy, there is a strong anticipation that this needs to and will grow. The increase in alternative capital alongside growth in the number of participants and the amount of traditional capacity will go hand in hand to support the direct buyer’s Cyber insurance requirements.

There has also been a lot of focus from reinsurers on non-breach privacy liability, which if this focus turns into action then this could result in this coverage being curtailed in original policies as reinsurers look to protect their results from this claims trend.

* Catastrophe Bonds & 144a Cyber Catastrophe Bonds – Catastrophe (cat) bonds are financial instruments used by insurance and reinsurance companies to transfer the risk of catastrophic events, such as natural disasters or widespread Cyber attacks, to the capital markets. Investors purchase these bonds and receive regular coupon (aka premium) payments. If a predefined catastrophe event occurs during the bond's term and meets certain conditions, the investors may lose some or all of their principal (aka capital or limit deployed).

More specifically, a 144A cat bond is a catastrophe bond that is issued in compliance with SEC Rule 144A. This means that the bond can be sold privately to institutional investors, such as hedge funds, pension funds, and insurance companies, without the need for SEC registration. These bonds are typically structured as special purpose vehicles (SPVs) and are often used by insurers and reinsurers to access additional capital markets capacity for managing catastrophe risk.

This has been really helpful, thanks Toby. Any final thoughts on what Cyber buyers should be mindful of as we continue into 2024?

It is important to note that in Q1 2024, we have seen an increase in claims activity which could result in a deterioration of reinsurer’s results. This has the potential to bring another hard market for Cyber reinsurance impacting the terms and conditions that insurers are able to achieve on their Cyber reinsurance. This then has the knock-on potential to influence to the pricing, terms & conditions that a direct buyer is able to achieve.