In 2020 and 2021, ransomware attacks increased the frequency and severity of losses, prompting insurers to reduce capacity and raise prices to the point where the "average cost of cover today is more than double what it was last year," with average increases of more than 120 percent over the last two quarters. According to the broker, this is "classic hard market territory."
"While the value of cyber insurance continues to prevail for the vast majority of buyers," Howden's David Rees said in a statement on the broker's report, "A Hard Reset 2.0." "Compounded increases from here are not sustainable, which, when combined with the more favorable claims environment that appears to be manifesting this year, is likely to moderate or even stabilize pricing." Improved insurer performance should also aid in the recruitment of new capacity into the market."
In addition to rate increases, insurers' underwriting changes have incentivized organizations to implement better cybersecurity controls, according to the broker. Better-prepared businesses face a lower risk of catastrophic losses and have "priority access to insurance capacity."
"Companies are more resilient to ransomware attacks today than they were at this time last year," said Shay Simkin, Howden's global head of cyber. He added that some of the decreased ransomware frequency appears to be related to the war in Ukraine, and that the ongoing impact "is a lot more unpredictable."
"It appears that the conflict has dampened cyber frequency even further as both warring parties concentrate their efforts on conventional warfare." This could all change in an instant – for example, a ceasefire, a large-scale cyberattack, or pressure on Russia's government to find new revenue streams as economic sanctions bite – but for the time being, insurance claims are lower than last year. "All of this raises serious concerns about the prioritization and efficacy of cyber operations during wartime," Simkin said.
According to the report, the war in Ukraine has also refocused the industry's attention on systemic cyber exposures and risk accumulation. Other recent attacks on critical infrastructure and widely used service providers have also raised concerns, according to Howden, but market losses have been limited.
"Of course, this is not to say that the threat of systemic losses is exaggerated, or that the situation will not worsen from here." A large-scale event, such as a widespread cloud outage, would clearly stress the market, as would any tail event in other lines of business, according to the broker.
According to the report, the recent progress represents significant growth for the still relatively new cyber market. If demand remains strong and capacity expands, gross written premiums could reach $25 billion by 2026.
"Hardened cyber defenses have left companies less vulnerable to prolonged disruption in the event of an attack or breach, and the cost of cover is now more commensurate with loss costs," Howden concluded.