Ãå±±ÂÖ¼é

Those fighting cybercrime and those who insure against it must perpetually race to keep up with the new tech, strategies, methods and goals thrown at them by nefarious actors working from all over the world.

After significant compound rate increases in 2021 and 2022, the cyber insurance market stabilized in 2023, with some areas experiencing slight softening as the market continued to adjust throughout 2024, according to Guy Carpenter’s new report, “.”

The global cyber market is estimated to be worth $16.6 billion in 2024, with North America accounting for $10.5 billion, Europe for $3.9 billion, the Asia-Pacific region for $1.7 billion and the rest of the world for $0.5 billion. Growth is driven by under-penetrated industries, developing regions, and new product offerings along with increased awareness of cyber risks and a growing reliance on technology.

North America leads in premium share and dominates in IT sector premiums, as the U.S. is home to nearly 70% of the world’s largest IT firms. The recent slower growth of premiums in the U.S. is a sign of market maturity rather than a lack of interest. In general, most coverages are offered across policies with limited restrictions on items like contingent business interruption (CBI) and ransomware.

While growth in North America is slowing, Europe and the Asia-Pacific (APAC) regions are heating up. Rapid growth in these areas benefits global reinsurers by diversifying risk and unlocking capacity in new markets. Insurtechs and SME-focused carriers that have found success in the U.S. are expanding to capitalize on this growth.

However, growth in these regions could contribute to aggregated losses with a wide range of potential modeled outcomes. For 2024, the modeled global aggregation loss potential is estimated to range from $20 billion to $46 billion at a 1-in-200-year return period, suggesting a market loss ratio between 120% and 277%.

The European region sees a more conservative approach to some cost components with contingent CBI offerings tending to be far more limited in scope and may require named cloud service providers to be affected to recover in some cases. Europe tends to have a conservative approach to coverages for General Data Protection Regulation (GDPR) fines as well, given the legal ambiguity around recoverability of those fines.

APAC tends to have an even more restrictive offering around business interruption (BI) and CBI. In many cases, there is also no coverage for ransom payments, further impacting the nature of losses the region may experience in the event of a cyber catastrophe.

These nuances in the coverages applied can influence losses experienced when modeling cyber catastrophes. This will be most pronounced in the tail, especially in the event of a ransomware or cloud event.

Evolving threat landscape

In 2023 and 2024, there was a noticeable increase in ransomware activity. However, there was not a corresponding rise in the severity of attacks thanks primarily to improved cybersecurity practices among insured organizations. As a result of this shift, attackers have increasingly focused on data theft rather than ransom payments, with 90% of ransomware incidents in the third quarter of 2023 involving data exfiltration. This tactic, double extortion, in which attackers steal and encrypt data, has become a significant concern for incident responders.

Ransomware/malware events remain the main driver of losses. These events remain a key concern for the industry, consistent across all individual regions. Cloud events still yield lower losses compared to ransomware/malware events while data theft events are the third-greatest contributors.

Cybercriminals increasingly target weaknesses in third-party services, which can have widespread effects and offer significant financial gain. Systemic cyber remains an area of concern with increased reliance on cloud services as well.

Responding to increasing cyber threats

As risk drivers shift, underwriters are responding by sublimiting coverages, raising retentions and increasing scrutiny on limits. Privacy regulation and litigation funding have also renewed attention on third-party liability, especially around wrongful data collection.

North America is the most advanced market for cyber insurance, particularly among large corporations, where a significant number of companies carry cyber coverage. Growth opportunities may arise from smaller businesses, emerging sectors and personal insurance lines. There remains a strong capacity for coverage from traditional insurers, with managing general agents (MGAs) introducing new capital into the market.

Topics Cyber