Helping clients understand the cyber reinsurance market
Issues with cyber security and ransomware are recurring concerns for businesses all over the world. In this episode, Guy Carpenter’s Erica Davis and Anthony Cordonnier, Global Co-Heads of Cyber, discuss the state of the cyber market, the effect of war exclusions and cyber policy language, the impact of ransomware, as well as capital structures, tools and coverage variations that affect the cyber market.
About Guy Carpenter's Fo[RE]sight Podcast Series
Our goal for this series is to bring to listeners unmatched insights on trending challenges and solutions, delivered by specialists from Guy Carpenter and other organizations on the forefront of thought leadership developments.
Transcript
Eric Stenson: I'm Eric Stenson from Guy Carpenter. Welcome to this episode of Foresight, a Guy Carpenter podcast series, bringing you unmatched insights on trending challenges and our solutions delivered by Guy Carpenter experts on the vanguard of thought leadership within the reinsurance industry.
Today, Guy Carpenter’s Erica Davis and Anthony Cordonnier, Global Co-Heads of Cyber, discuss the state of the cyber market, the effect of war exclusions and cyber policy language, the impact of ransomware, as well as capital structures, tools and coverage variations that affect the cyber market. Guy Carpenter’s Cyber Center of Excellence has the technical expertise to deliver unique solutions and the sophistication to optimize their value to your enterprise. Please welcome Erica and Anthony as they share their insights into the world of cyber.
I'd like to start with Erica. With ongoing conflicts in Ukraine and Gaza, war exclusions in policy language for cyber is an issue of considerable consequence. What updates can you provide regarding how these exclusions are changing and how they affect the cyber marketplace?
Erica Davis: Thank you, Eric. And this is such a relevant and challenging question. One of the biggest issues for the cyber market around language is the continuing disconnect between all of the various parties involved, from policyholders to insurers, brokers, market bodies and reinsurers. 2023 with the year where we saw rampant misinformation shared across the market on cyber war intent and its wording evolution.
And it's important to note that cyber war exclusions have always applied to these policies since their infancy. So, this is not a new phenomenon for the market. And there has yet to be a collective consensus for how war risk is defined and managed across the market. So, until that occurs, the market will continue to see further iterations of these war wordings being proposed across the market to reflect each party's view of risk.
One important thing to note from a Guy Carpenter perspective has been that we will sufficiently build capacity around our clients’ underwriting strategies regardless of what war wordings they implement. And the 1/1 market allowed us to do that successfully.
Eric Stenson: Thank you. I was also wondering, Anthony, the cyber environment has been known for its increasing pricing environment, which has now calmed down significantly. What do you think has changed the pricing trajectory and where do you think it might land going forward?
Anthony Cordonnier: Thanks, Eric. So, it's true that the cyber insurance market has experienced a shift in the year going from an extremely hard market to a much more at peace rating environments. So, this follows over two years of significant rate increases, which were as a as a response to a changing and shifting loss environment. So, these rate changes have led to a much stronger performance in insurers’ portfolios, and this has naturally attracted new entrants and new capacity into the markets as the market moves to a more mature stage. We're expecting to see fewer fluctuations and so we expect to see a much more stable pricing environment and an environment that is easier to navigate for buyers of cyber insurance going forwards.
Erica Davis: Maybe just one point before we move on to ransomware to expand on Anthony’s point about pricing. We have already seen signs of a more settled pricing environment as we look to the Q4 2023 results and as we engage with clients on their 2024 expectations. So, I do agree with Anthony that as we enter a more mature stage in the market, carriers are looking for differentiated risk and a more enhanced view of what appropriate risk controls look like.
Eric Stenson: Thank you. I was wondering, Anthony, can you tell us a little bit more about your team and the overall cyber practice?
Anthony Cordonnier: Yes, of course. Our global cyber practice has been a high growth team within the Gary Carpenter ecosystem. We have just over 35 professionals worldwide from the west coast of the US to colleagues in Asia, and we work closely together on broking analytics, insights across many different territories. The team is a very experienced team with people from diverse backgrounds, from the direct underwriting sides, direct broking, reinsurance underwriting, modeling, actuarial, and we bring that expertise and all those different angles, as well as experience in the US markets, the Lloyd's market and its national markets, to our clients wherever they are.
Eric Stenson: Erica, I know ransomware activity has been a major headline in the cyber world. How is ransomware affected the cyber marketplace, and what are some ways businesses can protect themselves from these sorts of attacks.
Erica Davis: When it comes to ransomware, following the heavily weighted ransomware losses of 2018 through 2021, there was significant tightening and the reinsurance and insurance market, and a global security crackdown on those ransomware threat actors. Now we're seeing those criminal groups shift tactics and techniques, including use of artificial intelligence, in order to counter the elevated risk controls implemented by the business community.
So, as we look to what the data shows us, there is a decrease and companies who are paying the demand, that's as recently as year-end 2023. That shows us that businesses are relying more heavily on restoration and used backups and remediation rather than paying the ransom demands. We are seeing increased cases of data exfiltration and compromise due to ransomware events, as these threats have evolved.
So, while we have businesses who have implemented improved risk controls, we are all anxiously awaiting whether those controls will prove sufficient as these attacks grow more sophisticated. Our advice from Guy Carpenter remains the same as it always has been with ransomware, which is that businesses must implement cyber hygiene practices across their organizations. They must continue to evolve those practices and view it as an integral part of their overall risk management strategy.
Eric Stenson: Thank you. Anthony, I know you discussed pricing earlier. Overall, how would you categorize the cyber market at 1/1 renewal? What have been some of the major changes we've seen from recent years?
Anthony Cordonnier: Thanks, Eric. Shifting gears from cyber insurance to cyber reinsurance, I would say that we saw a paradigm shift from the previous few years in our insurance markets this renewal, I would almost characterize that the market as bullish. And this year in recent years we saw demand for reinsurance increased significantly, both proportional and non-proportional covers. And the trend really was that supply was struggling to keep up, and a huge influx of capital was needed into the markets.
So, this led to significant price increases, particularly on a non-proportional treatise and a deterioration in sitting commissions paid to see for them to see their business to reinsurers. So, in late 2022 and early 2023, we saw more of an equilibrium in supply and demand, which led to a much more stable environment. And more recently, we saw an influx in reinsurance capacity, which actually led to cedents pushing for better terms and conditions, which is why I referred to this market as a lot more bullish.
On a more qualitative point, actually, we also saw clients reassessing their purchases. Of course, the trends we've mentioned around ransomware that Erica talks about and some rate increases, led us to more profitable portfolios, more attractive portfolios. And what seems more attractive to reinsurers is also more attractive to cedents. And cedents sealants started to retain a little bit more on their own balance sheets as they grew more comfortable with the business and also started looking at the non proportional purchases, looking at optionality in the kind of covers that were purchasing.
So, 2024 was not only a year of a more bullish markets, but also a year of innovation.
Eric Stenson: Oh, thank you. It certainly is a market that continually evolves. Erica: Could you briefly explore structural changes connected with capital and coverage variations in the cyber environment?
Erica Davis: Sure, I can do that. And I think it dovetails nicely with some of the points that Anthony made. The cyber market has reached a far more robust size and scale. Guy Carpenter has estimated the year end 2023 cyber market to be roughly $15 billion in gross written premium. We've also seen a progressed level of maturity, which means the sector is benefiting from a more credible view of attritional performance.
So, what does that mean? But better our confidence and how the portfolios are behaving along with some of the market improvements we spoke to earlier around improved pricing and improved risk posture. Our clients are re-evaluating their reinsurance buying strategies. As Anthony noted, they are seeking continuity of coverage. They are looking for costing efficiencies, as well as new possible structures to attract fresh capital to the space.
So those include occurrence covers, which continue to gain traction, as well as ILS bespoke cat covers, which also continue to gain momentum. One of the highlights of our 1/1 renewal season was the execution and launch of our new cyber cat cover, which is called CatStop Plus. And CatStop Plus is a blended approach to event cover and aggregate stop loss.
We feel it is solving for many of the hurdles and the cyber reinsurance market for how to address things like cyber cat about definitions. We're thrilled to have put that deal together for 1/1 and now have the wording, the modeling and the capacity available for our global client base. So, we're really excited about the developments that we saw throughout the year and 2023 and at 1/1, but we do expect the structural exploration to continue throughout 2024.
Eric Stenson: Well, it certainly sounds like there's a lot going on there. Anthony, Guy Carpenter is well-known for the analytics and tools it develops to help clients understand trends in various marketplaces. Can you tell us something about available tools in the cyber sector?
Anthony Cordonnier: Yes, of course, Eric. So, I will start by saying that as reinsurance brokers, we see our role much broader than just transactional. So, we sit in that privileged position where we see most of the market data, and we always challenge ourselves into thinking about ways where we can use this for our clients’ benefit.
So, we actually use the data we collect to form a view on market dynamics, on loss developments, on trends by industry, geography, revenue size. And using that data, we developed the GC Cyber Explorer Data Lake to deliver those insights to our clients. And the Data Lake consists of claims data, exposure data that we collect worldwide.
And then the innovation of this year is to reach the next generation, if you like, of analytics, which we see as user-led analytics. And this year we launched the GC Cyber Explorer Gateway, which actually gives clients access to the data I've just mentioned directly, and actually it allows them to benchmark their portfolio in real time. And it's not just the purview of our counterparts in the ceded reinsurance departments, but actual underwriters that can make decisions about their portfolio, in real time, using the data insights that we collect for them.
Erica Davis: So, one of the competitive advantages of the approach Anthony outlined is that the Guy Carpenter Data Lake does house over 9 billion in global cyber market data and therefore creates a very credible index for our clients to benchmark and understand their portfolio versus the global cyber market.
Eric Stenson: Thank you. I can certainly see where that guidance would have value.
I'm Eric Stenson and thank you to Guy Carpenter’s Erica Davis and Anthony Cordonnier for sharing their insights on the cyber market, how it's evolving, and issues such as war exclusion wording and ransomware, and how they affect conditions for stakeholders in the cyber market.
Anyone wanting to learn more or who would like to engage with a Guy Carpenter expert directly should visit guycarp.com and click on Explore Solutions.
Please look for the next episodes in our series, as we address additional themes connected with the reinsurance environment. And thank you to our audience for sharing this time with us and listening to Fo[RE]sight, a Guy Carpenter Podcast series.