Cyber may become insurance commodity, but exposures remain untested

Cyber premiums are expanding rapidly across the global insurance market. But for reinsurers, the central question is not simply how much premium the line can generate, it is whether the industry truly understands the exposures it is underwriting.

That tension point arose during the panel discussion, ‘The state of reinsurance: Balancing risk, returns & resilience’, which took place at the Business Development Agency Risk Summit, held in Bermuda this week. The session included John Huff (pictured far left), president and CEO of ABIR, Jerome Halgan (pictured left), CEO of Arch Reinsurance, Ryan Mather (pictured right), CEO of Ariel Re and Kathleen Reardon (pictured far right), CEO of Hiscox Re.

Mather placed cyber within a familiar pattern of insurance innovation. Risks that initially appear complex and specialist often evolve into standardised products over time. “When I think about cyber, I think about all the innovation that's happened in our industry. The first auto policy was written in 1897 – it's now a commodity. The first aircraft policy was written in 1911 – it's now a commodity. The first satellite risk was written in 1965 – it's a commodity. Cyber is exactly the same.”

But the panel did highlight the uncertainty surrounding the market today. Global cyber premiums have expanded quickly, but the underlying loss potential remains difficult to define.

“Yes, there's premium coming in. Yes, it’s very attractive in premium,” Mather said. “But of course, there is a lot of systemic risk embedded in that, and none of us really know what that looks like.”

That systemic dimension is shaping how reinsurers approach the class. Exposure limits and aggregation management are central considerations as companies attempt to control the possibility that a single cyber event could generate losses across multiple portfolios.

Part of the difficulty lies in defining the event itself. Cyber incidents do not always have clear temporal boundaries.

Reardon said: “If we think back a couple of years, we may have provided aggregate cover. But selling a per-event cover and agreeing on a contract wording – what is the definition of an event – when you could have somebody infiltrating your company for who knows how many years before? It's quite tricky.”

Progress is emerging as the market develops more consistent structures.

“The market has now evolved,” she said, noting that there is now “some agreement on the definition of event, and I think this is where it starts to take off.”

At the same time, emerging technologies may expand the threat landscape further.

“AI certainly seems to exacerbate some of the risks,” Reardon said, suggesting cyber exposure could evolve in ways that remain difficult to anticipate.

For reinsurers, the uncertainty is compounded by the way coverage evolves at the primary insurance level. Even small adjustments in policy wording can alter the exposure transferred to reinsurers.

“If the primary carriers decide to change one coverage, suddenly, as a result, everything is different for the reinsurer. It's incredibly complicated,” Halgan said.

The implication is that cyber is not simply a growth opportunity. It is also a capability test.

Halgan did call the growth of cyber exciting, caveating that “it shows that if you want to do well in our business today as re/insurers, you really have to invest a lot in capability.”

Ultimately, that capability comes down to people. Despite advances in modelling and analytics, the panel repeatedly returned to a core observation about the nature of the reinsurance business.

“We continue to be a people business,” Halgan said. “In the end, you're always going to have human beings making decisions, whether it's on the writing, managing, or hiring.”

That emphasis is particularly relevant in Bermuda, where a concentration of global reinsurance platforms has created a dense ecosystem of underwriting expertise. Asked how reinsurers view their role within the jurisdiction, Reardon summarised it succinctly: “tax, talent and trading globally.”

Among those priorities, talent may prove the most decisive.

“Bermuda has to be, if not the best, one of the top three places in the world to have a career progression,” she said. “The amount of talent we attract, and the skill that we help those staff build, such as the underwriting of the analytics or the capital expertise, is really setting up the island for a great next generation.”

Cyber risk may be a new frontier for insurers. But as the discussion suggested, the real competitive edge for reinsurers confronting uncertainty will lie less in capital and more in the expertise required to deploy it.

Did you get value from this story? Sign up to our free daily newsletters and get stories like this sent straight to your inbox.