The first cyber cat bond could spell some relief for corporates navigating a hard market for cyber insurance.
Corporate treasurers and risk managers whose companies face ever-increasing cyber risk may soon have a new tool to discuss with brokers and insurers as they build insurance towers and navigate the hard, capacity-strained market for cyber coverage: catastrophe bonds.
- Last month, U.K. insurer Beazley sold $45 million in cyber cat bonds, the first deal of its kind—following more than a decade of discussion about the product in the insurance-linked securities (ILS) market. The Beazley cat bond will pay out if the insurer exceeds $300 million in losses from cyberattack claims.
- Cat bond issuers pay interest to institutional investors who purchase the bonds; the investors end up paying out the principal set aside in a trust to the issuer only if indemnity or other loss triggers are set off by a specified type of storm, cyberattack or other catastrophic event.
More to come? The Beazley deal should fuel consideration of similar transactions to mitigate growing cyber risks that insurers worry pose a systemic threat, resulting in greater capacity to meet the needs of corporates, according to Peter Foster, chairman of WTW’s Global FINEX Cyber business.
- He said cyber insurers will most likely be the biggest issuers of cyber cat bonds, but corporates could also issue the securities to reduce loss reserving and free up capital.
- “Corporates could consider their own cat bond to provide greater capacity of cyber insurance projection,” Mr. Foster said.
- Another industry observer told NeuGroup Insights, “The bond solution will only be there for the very largest clients in the market—or maybe client groups.”
Corporates no strangers to cats. Cat bonds are well established in the property and casualty market, where they have mostly been issued by insurers and reinsurers seeking to transfer risk to investors who are looking for returns uncorrelated with financial investments, including pension funds.
- Some corporates looking for protection from natural disasters have also taken advantage of the market for cat bonds in recent years.
- A corporate “maxes out coverage from the traditional insurance market, then goes to the cat bond market,” said John Seo, co-founder and managing director of Fermat Capital Management, an investor in the Beazley deal. He cited corporates that have increased coverage of earthquake risk:
- Google and its parent Alphabet purchased $275.5 million of California earthquake risk protection in 2021 following two similar deals the year before.
- Also in 2021, Kaiser Permanente renewed and increased the size of its cat bond providing earthquake protection.
- “Even if the amount of cat bond coverage procured is modest, the impact on the traditional program can be significant,” Mr. Seo said.
Risk model concerns. Cyber cat bonds have long been discussed by ILS-market participants but concerns about the ability to accurately model cyber risk stalled potential transactions. The Beazley deal was privately placed by Gallagher Securities, the ILS arm of reinsurer Gallagher Re, and is tradeable under Rule 144A among institutional investors.
- It uses the cyber risk model developed by CyberCube, which Mr. Seo said is becoming the “industry standard for cyber risk transfer” and a model Fermat used.
- Another broker specializing in ILS, Aon Securities, also anticipates completing a cyber cat bond this year, according to CEO Paul Schultz, who has publicly credited maturing investor education and risk models for cyber cat deals finally coming to market.
- More traditional risk model providers such as RMS, acquired by Moody’s Investors Service in September 2021, have ramped up their cyber offerings. Jin Shah, managing director, capital markets and resilience, said RMS’s cyber model is already widely used by the insurance industry, and his firm has spent significant time educating investors how it works.
Reality check. Fred Barnachawy, managing director and CIO at DeshCap, which negotiates contracts and insurance payouts on behalf of insured clients, said that property risk is easier to model and contacts are fairly standard compared to those covering cyber risk. Plus, he said, property does not carry the liability risk that often emerges in the wake of cyberattacks.
- Mr. Barnachawy cautioned that the terms and conditions of early cyber cat deals are likely to be “constrained” and payouts limited, even after significant cyber events.
- “Cyber cat bonds may help with the capacity issue, but will it help with core protection?” he asked.
- What is clear, though, is the need for more coverage, capacity and innovation in cyber coverage. The National Association of Insurance Commissioners reported that 2021 data breaches increased 68% over the prior year. But despite trillions in estimated cyber losses, commercial premiums written totaled a relatively paltry $6.5 billion.
