by Jonathan Kent
Businesses everywhere are becoming more aware of cyberrisk, but finding insurance that offers meaningful protection has proven difficult and expensive. There are growing signs that the market is starting to find viable solutions and much of the innovation is happening here in Bermuda.
A leading example is Envelop Risk, which writes cyber reinsurance on behalf of MS Amlin, using its proprietary modelling and analytics tools. Bermuda was also home to the first cyber cat bond, sponsored last year by Lloyd’s insurer Beazley, with $45 million in notes listed on the Bermuda Stock Exchange. Everest Re is among the Bermuda reinsurers to have stepped up its cyber offerings and the Bermuda Monetary Authority has also reported an increase in the number of captives being used to provide self-insurance for cyber.
In this fast-growing and dynamic space, Mosaic Insurance is one of the most active and ambitious players. Its appetite for complex specialty risks and its embrace of high-tech underwriting tools makes cyber a natural fit for the 2021 Bermuda start-up.
The emergence of cyberrisk initially caught the insurance industry by surprise, with many traditional liability or property policies inadvertently providing “silent coverage” of cyber, while a lack of data made the pricing of cyberrisk riddled with uncertainty for underwriters.
Yosha DeLong, global head of cyber for Mosaic, said there was now a growing trove of data and loss experience supporting more informed cyber underwriting. “I think there’s sometimes an impression that we’re just throwing a dart at a dartboard,” she said. “But we have a lot of data underlying our pricing tools. We have data by country, by industry and for average ransoms. We can articulate the ultimate cost if a company is down for two weeks, if customers sue, or if it turns into a class action. All of that gets incorporated into the pricing tool.”
She cautioned that the cyberrisk landscape was forever shifting and insurers needed to be nimble. “The industry is getting to the point where we realise this isn’t a property or casualty tool you can use for months, or years. This is something that needs to be dynamic and changing all the time.”
Geopolitical uncertainty is one of the variables in the cyberrisk equation. Ms DeLong said the Russia-Ukraine war has had an impact. “We saw a fracturing of many of the ransomware gangs, because they had both Russian and Ukrainian members. That, paired with the recruitment of young men by the military in those countries, muffled ransomware activity for a while.
“The gangs that have been active tend to be smaller and less sophisticated. The frequency of attacks has started to pick up again, but overall ransomware activity in 2022 was well down compared to 2019–20.”
State-sponsored attacks present added challenges. Attributing them accurately is difficult, as the attacker sometimes masquerades as another country. The question over whether the attack is an act of war — thus invalidating most coverage — can then come into play. This is a topic of ongoing conversation in the industry, Ms DeLong said.
“We’ve been working closely with Lloyd’s to put together some comprehensive language around solutions we feel will both protect the industry from an accumulation or event, and also enable our customers to clearly understand where the coverage lines are drawn,” she said.
Multiple indicators point to strong growth ahead for cyber insurance. Cybersecurity Ventures projects that ransomware attacks will cost victims $265 billion annually by 2031, compared to about $20 billion in 2021. Munich Re estimates that only about 10 per cent of cyberrisks are insured, while a report by the Swiss Re Institute forecasts global cyber premium growth of 20 per cent annually to $23 billion by 2025.
Mosaic intends to grasp the growth opportunity. In March this year, Ms DeLong said the company will start to write primary cyber insurance to add to the excess-of-loss coverage it already offers out of underwriting hubs in Bermuda, London, Chicago, New York, Frankfurt and Dubai.
“We are very committed to this line of business and we have an aggressive growth goal to be a top-five carrier within the next five years,” she said. Mosaic’s cyber division is targeting $125 million in gross written premiums in 2023.
Mosaic’s structure is a differentiator. It takes the lead line of business its writes through its Lloyd’s Syndicate 1609 and syndicates the remaining risk globally. Mosaic describes this as a Syndicated Capital Management (SCM) strategy.
Mosaic launched its Bermuda cyber unit, headed by George Cole, in November 2021. It found an SCM partner in Everen Specialty Ltd (formerly known as Oil Casualty Insurance, Ltd) to support its cyber underwriting and hit the ground running. Mr Cole said: “We were fortunate to secure third-party capital through a partner on island at a time when it was very challenging for brokers to secure capacity. So, we came in at a great time when we were able to secure solutions for clients.”
Understanding an insured’s specific cyber exposures is key to evaluating the risk. Mosaic partners with California company Safe Security, leveraging its SAFE cyberrisk assessment platform. Mr Cole said clients have been doing a better job of bolstering their own cybersecurity in recent years, often driven by the standards required by their insurers, who have effectively become “pseudo regulators”.
Will capacity be there to meet future demand for cyber insurance? Ms DeLong believes investors are gaining confidence in the sector with greater availability of structured data.
Mr Cole added: “One of the biggest fears for investors coming into cyber is the aggregation of systemic risk and the challenges of modelling that. Loss ratios have reduced, partly due to sustainable pricing, but also because security standards have risen too, which has reduced the frequency and severity of events.
“I think the reinsurance market has got better at structuring some of their products as well. We seem to be moving away from a quota share market to an event, excess-of-loss structure, which can be more capital efficient. I think there’s been significant progress over this last 12 months that is enabling more capacity to come into the market.”
Bermuda will play a leading role in the future of Mosaic’s growing cyber business, Ms DeLong said. “The partnerships we have on the island are really important to us, on the reinsurance side, our SCM partners, and hopefully others in the near future.
We see Bermuda as an incubator of innovation in the cyber space and we feel this is going to be the place where we launch new solutions for our clients. So, Bermuda is a very important market for us.”
