Cyber catastrophe loss will be an opportunity for ILS investors: Lockton Re

The occurrence of a major cyber catastrophe loss event, while likely to lock-up most of the insurance-linked securities (ILS) capacity already deployed in the sector today, can also provide an opportunity to investors, as it should support understanding and belief in risk models while providing a higher-yielding opportunity, broker Lockton Re has suggested.

In a report that explores how the still developing cyber insurance market will react to a major cyber catastrophe loss event, reinsurance broker Lockton Re concludes that such an occurrence will only serve to stimulate more innovation in product development and more risk capital.

Basing their report around a scenario that sees a destructive malware attack which spreads globally, Lockton Re aims to shine a light on the consequences of a potential cyber catastrophe event.

Oliver Brew, co-author of the report, and London Cyber Practice Leader at Lockton Re, explained, “We wanted to explore the potential aftermath of a major cyber catastrophe, as this is an area which has been overlooked in discussions on systemic risk. We selected a hypothetical self-propagating destructive malware (named Ivan Wiper) and assumed a midpoint view of its impact globally.”

Conclusions from the work include that natural catastrophe events will be bigger and more destructive in all but the most extreme scenarios, that the market will benefit from taking a collaborative approach when a cyber catastrophe occurs, that the claims handling process will face bottlenecks, that some insurers and reinsurers may withdraw from the cyber sector, but that there is a strong appetite among others who look to capitalise on “dramatically improved rating conditions.”

Ultimately, the reinsurance broker believes a major cyber catastrophe loss event will be a “catalyst for innovation and product development.”

Large catastrophe and disaster events of the past have been catalysts for change across the insurance and reinsurance industry and from a market perspective they “often reshape the industry creating movement in risk appetite and acceleration in specialist capacity and expertise,” Lockton Re explained.

Oliver Brew said, “For the (re)insurance industry itself, our view is that the most likely effect of Ivan Wiper will be the acceleration of a cyber catastrophe market with new product innovation, and a growing consensus around common cyber war and critical infrastructure exclusions.”

Of course, there is a growing role for the ILS market in cyber risk, with now a number of cyber catastrophe bonds successfully issued and currently just under $430 million of risk capital outstanding connected to cyber risks.

Of the cyber cat bond currently in the market, the coverage is for low-frequency, high-severity cyber catastrophe events, only attaching for very extreme losses.

Lockton Re estimates that by the time its hypothetical malware cyber cat event occurred, the cyber ILS market would have roughly tripled to $1.5 billion, so still being a small sliver of the overall $100 billion plus ILS marketplace.

“Given the scale of the Ivan Wiper event, capital will be locked up from day one, so it is fair to assume a total loss,” Lockton Re explains.

It raises key questions, such as: what happened; why; what the impacts are; how the loss event compared with modelled scenarios; and are there any blind spots in the modelled output?

Lockton Re notes that, “The efficacy of models are core to the long-term success of this market.”

While Brittany Baker, VP of Solution Consulting at CyberCube and one of the industry experts Lockton Re consulted with for its report, commented, “The largest question for the capital markets is when the event happens, does it happen in an expected way?”

For its scenario of a damaging global malware event Lockton Re explained, “Ivan Wiper is broadly within expectations. This will be a key learning point and provide additional confidence in the models and ILS structures being traded.”

Adding, “Those funds which have been building an understanding over time through ‘dipping the toe in’ will be best placed to leverage the market dislocation.”

One ILS investor Lockton Re spoke with told the reinsurance broker, “We’ll lean in to take advantage of extended attractive conditions.”

Although Lockton Re cautions that, “There have been prior examples where this hasn’t been the case, such as in the aftermath of some wildfires which caused outsized losses for issuers of cat bonds.”

“A distressed segment plays into the hands of alternative capital,” another ILS investor told Lockton Re.

The broker goes on to explain how it feels the market will play-out after a major cyber catastrophe loss.

“Lead investors will be able to recapitalise the market with rates above natural-catastrophe bonds. (Re)insurers who demonstrate differentiated underwriting and exposure management experience will be favoured. Funds with de minimus participation have built the confidence in the asset class and will maximise returns by pivoting capital to support the distressed class. Funds who were watching from the outside waiting for the event, use this as a chance to follow on the coattails of the pioneers to benefit from the significant rate rises,” Lockton Re said.

In general, where there is an understanding that a cyber catastrophe loss event falls within industry and importantly modelled expectation, most reinsurance capital providers will be ready to pull the trigger and deploy more capital, Lockton Re believes.

For those ILS investors that have spent the time getting up to speed and comfortable with cyber risks, when the first major cyber catastrophe occurs, as long as it does not raise uncertainty or gaps in risk models, should present an opportunity to deploy more capital to cyber, at even better rates and terms.