At time of writing, Munich Re – the market leader in cyber reinsurance – had been the only reinsurer to state its position publicly, with a letter to cedants in April saying it would take “necessary steps” to ensure the risk it takes on is in line with its war appetite.
However, no other reinsurer has so far been so strongly explicit as Munich Re, even privately, with many reinsurers saying they would assess on a case-by-case basis. Swiss Re told this publication a war exclusion with specific reference to cyber war would be required, it but would be discussing this with clients (see full statement below).
The cyber insurance market is currently using a patchwork of war wordings across both sides of the Atlantic.
A mandate from Lloyd’s on updating cyber war language has led to a flurry of around 20 approved wordings by the Lloyd’s Market Association, not all of which perfectly fit Munich Re’s appetite. In broad terms, the LMA wordings look to assess and put boundaries around the scale of a war event.
Meanwhile, in the US, cyber risk mitigation firm CyberAcuView has developed a wording said to be similar to the Chubb approach to assessing war exposures. This generally centres around the concept of “proximity of war” – where the reaction of the UN, NATO or governments determines whether the cyber attack is an act of war.
The CyberAcuView wording is understood to have been adopted by many major cyber insurers, although some US and European cyber insurers are said to have done nothing to their war language at all.
The lack of cohesion in the market at both cedant and reinsurer level has led to questions around whether buyers will be able to secure back-to-back coverage, or the limit they want, at the 1 January treaty renewals.
Sources told this publication that Munich Re has indicated it will come off treaties where the underlying exposure does not fit with its appetite.
It has been suggested that the reinsurer is agnostic to the approach cedants take, and will support a transition period to updated wordings, but will not tolerate a head-in-the-sand approach from cedants.
In conversation with this publication, Chris Storer, who heads up Munich Re's Cyber Centre of Excellence for global and North American reinsurance clients, said: “We are seeing progress, and many markets acting in a responsible way with regards to updating their cyber war language.
“It is our belief that any market that continues to neglect this issue is running a material risk. The most important thing is how do we as an industry create conditions for sustainable growth in cyber, and the exclusion of ruinous exposures, like cyber war, is key to that.”
Swiss Re also gave its cyber war stance to this publication. CUO for specialty Anne Lohbeck said: “For cyber, a war exclusion with specific reference to cyber war is required. We acknowledge that the market is going through a development of exclusionary language, and we discuss what is acceptable with our clients and distribution partners in the specific context of each portfolio.”
The stance from Munich Re has led some cedants to request their brokers to replace Munich Re capacity on their programmes, or take that risk net, according to sources. Brokers suggested that, given that quota share capacity – where Munich Re plays – is fairly robust, this should be achievable.
Brokers are agreed that the cyber market needs better definitions around these exposures for a sustainable market, but are now faced with a complex challenge of arranging capacity around varying appetites for war risk.
Most in the market believe the cyber war question will not be definitively answered at the January renewal, with the likeliest scenario being a gradual drift towards one stance in the coming months or potentially years.
Many brokers are starting to stress-test various scenarios of reinsurer stances and are looking to plan for those, including the potential to use difference-in-conditions coverages which exist in other lines of business.
Jen Braney, Gallagher Re’s head of international cyber and consultancy lead, also stressed that systemic exposures encompassed more than just war.
“You could have an okay war exclusion, but a very strong critical infrastructure exclusion,” she said. “The industry shouldn’t get too distracted by one clause. We need to look at wordings holistically.”
“The industry shouldn’t get too distracted by one clause. We need to look at wordings holistically.”
Rising reinsurance demand
The debate around cyber war comes against the backdrop of increasing demand for cyber reinsurance protection, following two years of rapidly rising premiums in the insurance space.
Quota share remains the dominant structure, and here brokers feel there is adequate capacity after many programmes at the mid-year renewal were oversubscribed. Some markets are also choosing to hold more net after benefiting from more than two years of compounding rate increases.
"I would say the QS market is holding steady,” said Ari Chatterjee, CUO at Envelop Risk. “Any softening is on a deal-specific basis, perhaps because it was very well priced the previous year."
"In XoL, there is greater availability of capacity for deals around the $50mn-$100mn mark, but bigger deals are tougher to get done. The flood of ILS has not quite happened in the way people thought it might, but there are deals out there."
In terms of reinsurers thought to be demonstrating increased appetite at this coming renewal, sources pointed to the likes of Everest Re and Liberty Mutual Re. At the same time, the takeover of Validus by RenaissanceRe is likely to result in some cyber reinsurance capacity being taken out of the market, sources said.
“We anticipate modest growth in capacity offered by existing reinsurers, but we expect these to be capped by risk appetite constraints,” said Conor Husbands, senior underwriter at Hiscox Re & ILS.
“The number of new market entrants is small, and they tend to deploy modest capacity compared with the established market leaders. We therefore expect pricing adequacy for our portfolio to remain strong.”
There is increasing demand for event covers, as cedants become increasingly comfortable with attritional losses and seek to buy additional protection in the tail.
Guy Carpenter estimates there is just over $500mn of limit on event covers being placed right now. In comparison, stop-loss treaties still dominate the space with limits placed in excess of $5bn.
“After the rapid market correction and now instances of rates declining in some areas, insurance buyers are scrutinising the coverage they're buying and making sure it's fit for purpose. They're not shying away from challenging the structures that they've always purchased,” said Anthony Cordonnier, global co-head of cyber at Guy Carpenter.
“Demand continues to increase as the market continues to grow. But I think buyers are a lot more sophisticated in their approach and are conscious that there are alternative solutions both in terms of the capacity they're accessing, but also the structures they're buying.”
The reinsurance market will remain imperative for the cyber market, according to S&P Global, as primary insurers ceded approximately 50% to 65% of cyber insurance premiums to reinsurers in 2022, depending on the region.
S&P does not expect the market to soften as it has for primary cyber insurance. This is evident from the reinsurance segment's higher rate adjustments so far in 2023, it said.
More rate increases are expected this year, but the ratings agency expects primary underwriters can absorb the increases without passing them on to policyholders.
S&P Global believes (re)insurers need to diversify their sources of back-up protection when expanding in the cyber space.
"With risk-adequate pricing, we see an opportunity for (re)insurers to partner with the capital markets and increase their capacity,” it said.
“In our view, despite the many challenges, third-party capital could become a vital component in the development of a mature cyber insurance market."
At the current growth rates of the market, the industry will reach limits of what the cyber (re)insurance market can financially bear in the coming years, said Swiss Re’s Lohbeck.
“To continue to support growing demand for cyber insurance, new capacity needs to be generated. Access to risk capacity from capital markets and/or government-backed schemes for the worst accumulation scenarios are options which are starting to be explored.
“Also, new products get explored that split cover into accumulating and non-accumulating components.”
ILS potential
Following a watershed cyber ILS transaction for Beazley this year, the market has been speculating whether this would effectively open the floodgates in the use of ILS capital for cyber reinsurance.
Beazley became the first (re)insurer to place cyber risk into the cat bond market, raising $45mn of a hoped-for upper target for limit of $100mn with its Cairney deal in January.
The ILS market does want to fill a market need in cyber, but progress will be gradual, sources said. It was suggested that cedants are looking at ILS structures for both attritional and remote tail risk – although investors are generally showing a preference for remote cat risk in cyber at present.
“I think you will see growth in the space,” said Theo Norris, cyber account executive for ILS at Gallagher Re. “We're not going to suddenly see billions and billions overnight, but I don't think we're too far away from some serious numbers once we got a few more structures and products.”
