CyberCube estimates insured losses from CrowdStrike event at $400m to $1.5bn

CyberCube, a specialist modelling firm for cyber risks and exposures, has estimated that insurance industry losses from the CrowdStrike linked global IT outage for the standalone cyber insurance market will be between $400 million and $1.5 billion.

According to CyberCube, last week’s IT outage represents a loss ratio impact of somewhere between 3% and 10% on global cyber premiums of $15 billion.

The company views the event as somewhere between the 1-in-2 and 1-in-6 year industry loss return periods, based on its cyber catastrophe model and industry exposure database.

While industry loss estimates are still preliminary as the fallout becomes clearer, CyberCube states that a loss of this scale could make the CrowdStrike incident the largest single insured loss event ever in the affirmative cyber insurance sector.

But while a significant event and reminder of the risks linked to technology and the increased interconnectedness of the world, CyberCube notes that an event of this scale is still far from the extreme scenarios currently being modelled by cyber re/insurers.

The specialist modelling firm’s Cyber Aggregation Event Response Service (CAERS), which provides up-to-date intelligence on major cyber catastrophes worldwide as they happen, was activated by the CrowdStrike linked IT outage.

“CyberCube’s Portfolio Manager product, which is used by 30 of the 40 largest US and European cyber insurers, shows far more destructive scenarios that can reach loss ratios of 234% in more extreme events at 1-in-200 year return periods. As such, the CrowdOut event is a major event for the cyber insurance market but does not come close to the destructive potential that leading insurers are holding capital against,” says CyberCube.

This insured loss range from CyberCube comes after Parametrix, a specialist in parametric cloud downtime cyber insurance and reinsurance protection, released an insurance industry loss range of $540 million to $1.08 billion for the event.

As we said yesterday, an industry loss of below $1.08 billion is not expected to impact any of the cyber catastrophe bonds currently in-force, and we expect that this would also be the case for an insured loss of below $1.5 billion.

While the cyber insurance and reinsurance market has expanded rapidly in recent times, large retentions and low policy limits suggests only a small portion of the overall losses will be covered by cyber insurance.

It’s worth noting that CyberCube’s industry loss estimate for the CrowdStrike event is for the standalone cyber insurance market only, so does not seem to include claims that may flow via business interruption clauses from other policy lines, or any additional insured claims under E&O, for example.

In addition, the wide range in the loss estimates for the CrowdStrike outage we’ve seen so far suggest that significant uncertainty still exists surrounding cyber catastrophe events and precisely how losses from them will fall, even within the standalone cyber insurance space only.

That is reflective of the policy term customisation that has been seen, which makes it very challenging to cut across the sector and make broad-strike estimates. All of which means clarity and a more accurate industry loss estimate is going to take some time.

Also read:

– Parametrix estimates CrowdStrike insured losses at between $540m and $1.08bn.

– Beazley CrowdStrike losses expected well-below cat bond attachment: Berenberg.

– Beazley says no change to combined ratio guidance after CrowdStrike.

– CrowdStrike tests cyber cat bonds & reinsurance, demonstrates importance: Aon’s Egan.

– CrowdStrike outage: Cyber cat bond prices stable, uncertainty palpable.