London Market: black swan fears suppress cyber appetite

“The cyber black swan event hasn’t happened yet but it’s scaring people and it’s the cyber equivalent of a hurricane catastrophe.”

This was the view of Paul Cumberland, executive director at Howden Markets, as he discussed the appetite for cyber in the London Market.

Cyber has experienced reduced underwriting appetite across the London Market despite expectations that the class will see a large rate increase this year, according to Howden’s 2022 London Market Appetite Survey published in March.

Cumberland was speaking as part of an Intelligent Insurer panel on the London Market, which discussed market conditions, carriers reducing their catastrophe exposure, and the prospect of new business in certain lines.

His fellow panel members were Scott Bailey, managing director, cyber at Markel International; and Peter Fitzsimmons, head of onshore renewable energy at Axis Insurance; with Claire Churchard, deputy editor of Intelligent Insurer, as moderator.

Reduced appetite for cyber has been caused by the emergence of ransomware, which appeared quickly in around 2019, Bailey said. “It’s become prolific in the past couple of years, so a lot of carriers have seen adverse loss trends, certainly less margin of profit in the class than they’d expected.”

The spectre of a systemic cyber event is also suppressing appetite.

“A black swan event is ever-present in the minds of everyone in cyber. Any change in appetite has to be about whether the adequate profit margin is large enough to offset concerns over systemic risk, or enough to buy appropriate reinsurance to protect that cat event.

“That really underpins where the market’s thinking is right now,” Bailey said.

He stressed that ransomware is not the cyber market’s first adverse loss trend and that now there are more markets and carriers in the space than ever before.

“If you rewind five to 10 years, a lot of carriers who were in the space back then will recall that there was an adverse loss trend in the US health space, and in the payment card retail space predominantly in the US.

“There have been some heightened loss trends where there has been a curtailment of appetite from the market. Many carriers have paused appetite as we’re witnessing now,” he added.

Carriers are taking stock of the situation and analysing what’s driving the loss trend and how to best mitigate some of these threats, Bailey said.

“That naturally happens over a period of months probably, rather than years or weeks, but I think we’re going through that ransomware mitigation right now and the industry has done a great job over the last few years of fine-tuning how we mitigate this exposure, what are the killer risk management measures that will reduce the loss trend and how we insist that every one of our insureds is doing the right things.”

This mitigation push has had a very positive effect on the behaviour of insureds and the way carriers influence how businesses approach this threat, Bailey added.

”As a result of that you will see the loss trend normalise a bit, obviously coupled with the rate increases that have happened in the past couple of years. I believe there will definitely be a return of appetite in the next 12 to 18 months.”

But, he added, there will be a new loss trend in cyber. It’s a fast moving space and no loss trend prevails for more than a couple of years, when it is typically replaced by something new.

Known unknowns

Cumberland agreed with Bailey, saying the appetite is “just riding the tide of the rate increases” and that there isn’t any appetite for new business.

“That’s born out of the ransomware losses that have been experienced recently. There’s the fear of a systemic event which hasn’t happened yet, but everyone is expecting,” he said.

“When it does it’s going to be very interesting, it will be the ultimate cat event—multiple losses emanating from one particular cause or source. The black swan event hasn’t happened yet but it’s scaring people and it’s the cyber equivalent of a hurricane catastrophe.”

Cumberland also agreed with Bailey that risk management efforts implemented by insureds will start to bear fruit. “We will have two years’ worth of pretty strong rate increases in reflection of those ransomware losses. When the risk management starts to kick in and bite and the profitability flows through from that higher rate adequacy, maybe then the new business appetite will start to come back in again,” Cumberland commented.

He questioned whether insurers would get their heads around the systemic cat exposure for cyber, adding that it remains an ongoing fear.

“On the property side you can get your head around a hurricane fairly easily. With the cyber event nothing has happened yet, so there’s a level of uncertainty which is causing consternation,” he said.

Bailey offered some reassurance, saying that the modellers and the professional entities, companies and insurers are trying to get a better grip on a cyber systemic event.

“The understanding of an event like this is much more sophisticated than we’ve seen before. We’ve still got a distance to go to get a more intimate understanding of everything and what that systemic exposure looks like, but I definitely feel the industry is in a much better space than it was a few years ago.

“I hope that as each year passes we will become more sophisticated in the way we approach that,” he concluded.

For more on the Howden report click  here

For more on this London Market panel discussion,  read our companion feature with a focus on renewables