The recent moderation of cyber insurance price increases could pave the way for new buyers to enter the market and make life easier for existing customers.

Cyber prices stabilizing in the second half of 2022 and the first half of 2023 has resulted in an improvement for those clients renewing their cyber cover, and "really good news in terms of being able to bring new buyers in and grow the market," Glyn Thoms, head of cyber and technology, media and telecoms for Great Britain at Willis Towers Watson PLC, said in an interview.

Thoms said the cyber market has big aspirations for growth that are only achievable if new buyers come in.

"We have to have a market that is open for business in order to do that," Thoms said. "If I'm being honest, I think what we saw through the hard market was not a market that was really open for new business."

For existing customers, the rate increases and coverage restrictions that insurers were imposing when the hard market was in full swing "wasn't sustainable in terms of clients continuing to see the value of the cover," he added. "Some things had to change there, which fortunately they have."

Prices were soaring by 150% heading into 2022 but are now ticking up by 10% to 15% on average, according to Brian Warszona, UK deputy cyber practice leader at Marsh LLC. In some cases, reductions ranging from 10% to 25% are being seen, Warszona said in an interview.

"It's stabilizing to the point where clients can actually budget and plan for the cost of it," he said.

Pricing has also become more predictable. Sudden price changes two weeks before renewal were not unheard of in the past, but now, "we can actually have formal discussions three-to-six months out again," Warszona said.

Adversity spurs invention

While the hard cyber insurance market has been painful for coverage buyers, it has resulted in risk profile improvements. In addition to price increases and tighter terms, insurers have been demanding higher levels of cyber resilience from clients before they will cover them, which has bolstered their defenses and made them more insurable.

Vanessa Leemans, head of cyber, UK and Lloyd's, at AXA XL, thinks more buyers will come into the market, and that some of them will have already improved their cyber security defense measures before buying insurance cover.

"Over the last two years, we have seen clients improve their security maturity, and I would say that cyber insurance has played a key role in the security efforts," she said in an interview.

The hard market has also spurred new ways of thinking about ways of tackling cyberrisk beyond traditional insurance. Some cyberrisk has been pushed to captive insurers or parametric products, which pay out automatically when certain triggers are hit.

Price increases may have eased, but insurers continue to be selective about the risks they underwrite. Adequate cybersecurity measures are key to buyers getting the cover they need.

"There will be capacity available if [clients] can comply with the minimum standards that are required," Mark Rubidge, a director in the major risks practice at Arthur J. Gallagher & Co.'s UK-based international division, said in an interview. If not, clients may face coverage restrictions, higher deductibles or no cover at all.

Changing landscape

The cyberthreat environment also continues to evolve. Ransomware, which triggered the hard market, has not gone away. Cyberattack frequency is starting to creep up after a large drop-off following the onset of the Russia-Ukraine war, according to Warszona, although the attacks are not war-related.

Ransomware itself is evolving. Leemans said there were now "triple ransomware attacks," where hackers demand money to unlock systems they have encrypted, and then from both the targeted companies and their customers to prevent the release of stolen data.

The recent MOVEit attack, which is now thought to have spread to hundreds of companies, "is a great reminder that it's still out there," Thoms said.