Cyber cat bonds issued so far “highly correlated” with each other: Plenum

While the catastrophe bond market cheered the emergence of cyber cat bonds in 2023, fund manager Plenum Investments has offered a note of caution, saying that as they all cover cyber loss events that would be in the far tail, they are all correlated with little diversification on offer between them.

As a result, Plenum Investments explained that, of the four 144A cyber catastrophe bonds that have been issued so far, it is treating them all as identical risks and so is limiting its investment funds exposure to them.

Dirk Schmelzer, Managing Partner and Head Fund Manager ILS at Plenum explained, “Although they differ in terms of structure and de- tailed risk exposure, they cover all cyber risks in the “far tail” and offer little diversification potential between them.”

Schmelzer continued to explain that, at Plenum Investments, “We consider the first Cyber CAT Bonds to be an attractive and high yielding risk with interesting prospects and have added some to our CAT Bond portfolios.”

But added that, “Given the low diversification potential within the risk class, we treat all Cyber CAT Bonds as identical risks and have limited the overall allocation to 2% of NAV in the Plenum CAT Bond Dynamic Fund and the Plenum Insurance Capital Fund.”

Correlation has always been a concern for cyber reinsurance deals, especially when they are for the largest primary underwriters of this risk, as has been seen with cyber cat bonds.

But, at the same time, there are elements of differentiation in how underwriters approach cyber risk, how they work with their primary insureds to enhance their cyber security, as well as in the terms and conditions they offer.

But still, when it comes to a major cyber loss event that is on a scale likely to trigger catastrophe bonds, the correlation tends to emerge as these have to be really significant cyber events, given how high up cyber cat bonds attach.

Schmelzer noted that investor demand was strong for the first 144A cyber catastrophe bond issues, helping them to upsize and reach over $400 million in cyber risk transferred to the capital markets, across the group.

He said this is “a success considering that this is a new, complex and dynamically changing risk,” while also explaining that, “the high risk premiums of the new CAT Bonds were certainly the basis for the success of these new issues.”

“Relative to other, more established risks in the CAT Bond market, the bonds carried higher risk premiums, reflecting the higher uncertainty in risk modelling and the market’s reduced familiarity with this risk,” Schmelzer explained. “Part of this “novelty premium” is likely to decrease with further cyber CAT Bond transactions and over time.”

Schmelzer highlights similarities between the issuances, in that the risk chiefly or solely comes from the United States in each case, which he explained is “the largest cyber insurance market.”

In addition, the risk is relatively concentrated to specific industries and so “the extreme risk transferred by cyber CAT bonds is dominated by a small number of industries,” with financials, retail, IT and manufacturing making up most of the exposure in each case.

On how cyber cat bonds differ to the more typical natural catastrophe bonds, the event definition is far broader, Schmelzer believes.

“The most far-reaching differences to conventional natural catastrophe CAT Bonds are in the event definition. The majority of CAT Bonds use risk definitions that are clearly described both spatially and temporally and must be confirmed by independent third parties, such as meteorological authorities. However, the nature of cyber risks requires a much broader definition,” he explained.

Because of the broad nature, there are additional clauses to describe the causes of cyber events, where a threat originates, that a cyber event must impact multiple insured parties, and exclude untargeted cyber attacks such as phishing, for example.

Exclusions were also enforced to calibrate the cyber cat bond coverage further, with war and state sponsored events excluded, among other exposures/losses that a cyber event could cause.

While Schmelzer of Plenum sees the cyber cat bonds as correlated with each other, he also notes they do aid portfolio diversification.

“Cyber CAT Bonds are highly interesting additions to CAT Bond portfolios for several reasons. They make a significant contribution to diversification, as these bonds are largely uncorrelated with natural catastrophes that are typically covered by traditional CAT Bonds. At the same time, they carry a very high risk premium. Improved portfolio diversification therefore does not result in lower returns,” he explained.

But added that, given the four cyber cat bonds similarities, despite differences in their structure, “A prolonged outage of cloud services, for example, could lead to the default of all cyber CAT Bonds. The correlation in the event of an incident is therefore close to 1 and leads to a further cluster risk in the portfolio in the event of over-allocation.”

He also noted that cyber loss events could trigger effects in broader financial markets, so increasing the correlation of cat bond investments with other investments in a broad asset allocation.

“However, as long as these aspects are sufficiently taken into account in the portfolio construction of a CAT Bond portfolio, the addition of cyber risks is an attractive supplement and generates substantial additional benefits both in terms of improved diversification and in terms of the achievable risk premiums,” he added.