Cyber Cat Bonds: Key solution to closing global cyber protection gap- Report

Joy Agwunobi

As cyber threats like ransomware, data breaches, and IT outages escalate, cyber insurance has become a critical tool for managing these risks, with global premiums soaring from $1.5 billion in 2013 to $15 billion in 2023. However, despite this growth, a large protection gap remains, leaving businesses exposed to cyber incidents.

A new report from the Geneva Association, a global body of insurance companies, warns that traditional insurance models alone are insufficient to tackle the growing scale of cyber risks. It highlights financial innovations like catastrophe bonds (Cat bonds) as a potential solution to closing this widening protection gap.

The report, titled “Catalysing Cyber Risk Transfer to Capital Markets: Catastrophe Bonds and Beyond, emphasises how alternative risk transfer (ART) mechanisms, such as Cat bonds,” could significantly enhance the capacity to manage escalating cyber risks.

As businesses and societies continue to digitalise, cyber risks such as ransomware, data breaches, and IT outages have emerged as significant concerns. These incidents cause severe operational disruptions and financial losses, prompting organisations to seek more comprehensive ways to manage the risks.

According to the report, cyber insurance has grown exponentially in the past decade, with global premiums soaring from $1.5 billion in 2013 to approximately $15 billion in 2023. Despite this impressive growth, a massive protection gap remains, leaving businesses vulnerable to the full impact of catastrophic cyber incidents.

The report stresses that while cyber insurance has become a crucial tool for mitigating risks, it is not enough on its own to protect against extreme, large-scale cyber incidents. The size and uncertainty of potential losses from catastrophic cyber events such as a global ransomware attack or a widespread data breach have made it increasingly difficult for traditional re/insurers to manage the risks effectively. The challenges are compounded by the unpredictability of cyber threats and the absence of standardised coverage in many insurance policies.

“The growing complexity and frequency of cyber risks are outpacing the capacity of the re/insurance sector, which is now turning to alternative risk transfer (ART) solutions. These mechanisms, such as insurance-linked securities (ILS), have emerged as a potential solution for attracting additional risk-bearing capital from outside the re/insurance sector.,” the report noted.

The Geneva Association’s report examines how cyber ILS can be used to transfer peak cyber risks and help close the protection gap. One of the key innovations highlighted in the report is the use of catastrophe bonds (Cat bonds), financial instruments traditionally used to transfer the risks associated with natural disasters, such as earthquakes or hurricanes.

According to Jad Ariss, Managing Director of the Geneva Association, Cat bonds could play a vital role in scaling up cyber risk management.

“Cyber insurance plays a crucial role in mitigating cyber risks, but scaling the market requires fresh thinking and new sources of capital. Tools like Cat bonds, which have predominantly been used so far for natural catastrophes, could significantly boost risk-absorbing capacity to cope with catastrophic cyber incidents and help narrow the huge global protection gap,”  Ariss said.

While the appetite for cyber ILS is growing, the report cautions that the market is still in its infancy. Darren Pain, director of cyber at the Geneva Association and author of the report, explained that there are several challenges to overcome before the full potential of ART solutions for cyber risks can be unlocked.

According to Pain, the complexity of cyber risks and the wide variation in the extent of coverage in policies present challenges to widening the investor base.

“Progress in modelling capabilities and policy standardisation will be key to fostering confidence among investors and unlocking the potential of ART solutions for cyber risks,” Pain added.