Cyber insurance premiums increased by a third in the last 12 months

Cyber insurance premiums have soared by almost a third in the last year thanks to an explosion in ransomware incidents.

That's according to a report, titled Cyber Insurance: A Hard Reset, from international insurance broker Howdens. The company recorded a 32% rise in premiums between June 2020 and June 2021, and said that it shows no sign of slowing.

"With major cyber (re)insurers increasing their loss picks in response to higher claims inflation, clients can expect pricing to continue to rise through 2021 and potentially into 2022," Howdens said.

Claims have accelerated dramatically, according to the report, and ransomware is largely to blame. First-party claims under dedicated cyber insurance policies reached almost 9,000 in 2020, compared to just 1,000 in 2015.

This increase in claims, along with a jump in payment sizes, has sent the loss ratio (the ratio of insurance losses to premiums earned) among US underwriters soaring to 70% in 2020 from under 30% in 2018.

This rise in claims is also prompting underwriters to pull back from cyber insurance. The proportion of brokers in the US reporting diminishing capacity for cyber insurance coverage grew from 10% in Q1 2020 to over 70% in Q1 2021. Demand also rose from 60% to over 90% in that period, creating a classic supply crunch.

When they do take on cyber risk, companies are far more strict about their clients' cyber security measures, the report warns. They are also adopting new measures to mitigate the risk, including sub-limits and coinsurance, where the client pays a proportional amount of the cost for a cyber incident.

Policy coverage for cyber events have been reliable, suggests the report, citing the OECD. All policies across Australia, Canada, Japan, the Netherlands, the UK, and the US covered data breaches and network security liability, while fewer covered communication and media liability.

Technology disruption and cyber extortion garnered the least coverage, but more than nine in ten policies still covered these incident types, the report found.

However, Howdens noted that many cyber incident exposures are still covered by property and casualty contracts, and insurers are likely to adjust their risk profiles in dedicated cyber insurance contracts.

"The prevailing mood is one of caution, and a number of businesses are finding themselves in a ‘catch 22’ situation where cyber exclusions or sublimits are being imposed in their property or liability policies and they are encountering supply issues in the dedicated cyber market," the report said.