The evolving cyber risk landscape was a topic of discussion at this week’s InsTech Exponential Risk event in London.
Panellists referred to an absence of cyber catastrophe risks, instead referring to a number of less severe “kitty cats” that have barely moved cyber re/insurance markets.
Given this absence of large cyber re/insurance cat events, a question was posed about how cyber reinsurers and cyber catastrophe bonds price in considerable uncertainty about the real risk-on-line.
This same uncertainty might also be driving up modelled loss estimates for cyber-related incidents, such as last year’s CrowdStrike outage, which caused widespread temporary disruption but only a small insured loss.
Souki Chahid, head of cyber analytics at Guy Carpenter, dismissed the notion that cyber catastrophe risk transfer is unnecessary, arguing that the reinsurance broker’s role was critical in managing volatility.
“Otherwise, I would not have a job as a reinsurance broker for cyber specifically,” Chahid stated.
She emphasised that reinsurance remains an essential risk transfer tool, particularly as event covers and catastrophe bonds gain traction to address accumulation risk.
Chahid also highlighted the collaborative nature of cyber risk assessment, explaining that reinsurers work closely with cedents to develop a shared understanding of risk.
“We are all building a view of risk, using vendor models, realistic disaster scenarios, or our own methodologies,” she noted. “Reinsurers actively engage with cedents to refine these assessments and enhance market understanding.”
On the issue of potential for loss estimate inflation due to the unknown nature of risks, Chahid took a balanced stance.
The discussion underscored the complexity of cyber risk modelling and the evolving nature of cat bonds in this space. As cyber threats continue to grow, reinsurers and investors alike must navigate an intricate balance between uncertainty and informed risk assessment.
While acknowledging the existence of unknown perils, Chahid stressed that the industry does not arbitrarily overestimate losses.
“Even in established lines of business, there are non-modelled perils, but we don’t simply apply an automatic large loading,” she explained.
Instead, risk estimates rely on judgment calls to determine whether identified exposures are severe enough or if adjustments are necessary, she added.
No comments yet