The U.S. cyber insurance market has experienced a notable slowdown in premium growth coupled with a steady decline in loss ratios, reflecting a maturing industry that is adapting to the evolving cyber threat landscape, according to an analysis by AM Best.
In 2023, the premium growth for U.S. cyber insurance saw a mere 0.1% increase in direct premiums written (DPW), reaching $7.244 billion, as reported by the National Association of Insurance Commissioners (NAIC). However, AM Best suggests that a significant portion of cyber premiums may come from non-NAIC filers, such as captive insurers and Lloyd’s of London, which are not included in this data.
The analysis highlighted a 2% decline in standalone cyber policy DPW, dropping to $4.986 billion, marking the first recorded decrease. Meanwhile, premiums for packaged cyber policies saw a slight increase, rising to $2.257 billion.
Despite a sharp rise in ransomware attacks in 2023, which led to a 50% increase in first-party claims, cyber insurance loss ratios have steadily declined. The U.S. cyber insurance loss ratio decreased from a peak of 66.9 in 2020 to 41.6 in 2023. AM Best attributes this decline to improved cybersecurity practices among insureds and a trend of refusing to pay ransoms in over 70% of cases, reducing the severity of claims despite the higher frequency of attacks.
Third-party claims continue to constitute over 20% of cyber insurance claims, indicating a persistent tail in this business, according to the analysis.
Surplus lines carriers have taken the lead in the cyber insurance market, accounting for 59.2% of all cyber DPW in 2023. These carriers are well-positioned for growth due to their ability to respond swiftly to the changing needs of insureds without requiring approved policy form language. This flexibility is particularly advantageous for serving small and medium-sized enterprises transitioning to digital environments, AM Best noted.
Challenges and Opportunities for Insurers
AM Best has assigned a stable outlook for the global cyber insurance market, citing positive trends in premium growth, loss ratio, rate stabilization, modeling advancements, and growth in the insurance-linked securities (ILS) market for cyber coverage.
Systemic risk and the potential for risk aggregation have emerged as significant concerns for cyber insurers. While insurers seek to limit their aggregate exposure, the models used to estimate systemic risk have yet to be tested, which tempers the reliance on these models, AM Best stated.
Cyber insurers also face the challenge of heavy reliance on reinsurance, with over 50% of cyber premiums ceded to reinsurers—more than any other line of insurance. “This dependence on reinsurance leaves cyber insurers somewhat at the mercy of their reinsurers,” AM Best stated. “With cyber insurers already focusing on aggregate exposures to systemic risk, any pullback by reinsurers to limit their own capacity on cyber coverage will certainly flow downstream to primary insurers and limit primary insurers’ appetite for cyber insurance.”
Artificial intelligence (AI) has emerged as a significant concern for cyber insurers, particularly regarding media liability and intellectual property. AM Best noted that AI’s reliance on external inputs makes it vulnerable to allegations of copyright violations. The highest-profile case currently is The New York Times’ lawsuit against OpenAI for ChatGPT’s use of Times content without permission or proper citations. The outcome of this case could set a precedent for cyber insurers’ liability for AI content, potentially reshaping the industry, AM Best said.
