Worth almost $100 billion, the ILS market is an important source of capacity for (re)insurance and retrocession, mainly within the natural catastrophe space. According to Aon PLC, investors in ILS provided around $97 billion in capital at the end of the first quarter of 2022, slightly up from $96 billion at year-end 2021. This amount represents about 15% of the capital provided to the global reinsurance industry in total, and has remained relatively steady since 2018. In contrast, over the same period, capital from traditional sources has increased by 12% (see chart 1).

Chart 1

ILS capital is invested in the insurance industry in various ways, for example, catastrophe bonds; sidecars, that is, structures that allow for private investments in insurance risks; collateralized reinsurance; or industry loss warranties (ILWs), reinsurance contracts that take effect when industry losses reach a certain level. The main purpose of ILS capital is to assume (underwrite) risk where there are high concentrations of exposure to ensure that, in the event of a major loss, the risk is not only shared among global reinsurance companies and their debt and equity investors, but also among investors in the broader capital markets. This allows reinsurers to protect their earnings and capital from natural catastrophe events, and investors to make their portfolios more diversified by investing in assets that have a low correlation with other financial markets. Historically, as long as the pricing was attractive, ILS capital has filled the gaps where traditional capital had either retrenched or was unavailable.

This is where the cyber insurance market now presents an opportunity. The demand for protection from cyber risk is increasing, but the capacity offered by the (re)insurance sector is not growing at the same pace, leading to significant policy rate rises and a protection gap. This could provide an opening for ILS investors to gain exposure to cyber risks, in the same way they did with natural catastrophe risks in the nineties following Hurricane Andrew in 1992. However, so far, ILS investors have not shown much interest, and in S&P Global Ratings' view, the cyber ILS market is still in its infancy. So what's holding them back?

ILS Investors Have Been Bitten By Natural Catastrophe Risk

Overall, the ILS market has not grown as much as some market participants had expected it to five years ago. The main reason for this limited growth is the low investment returns that ILS investors have had since 2017 and the strong performance of the debt and equity markets up until recently. Investors also learned the hard way that they can be exposed to perils that they had not fully modeled and/or priced for, such as wildfires, tornadoes, floods, not to mention the COVID-19 pandemic. Usually, insured losses from these secondary perils are less severe than losses from hurricanes, tropical cyclones, earthquakes, and tsunamis. However, in recent years, secondary perils have increased in frequency, and, in aggregate, resulted in higher losses for investors than they had expected (see chart 2).

Chart 2

Hence ILS investors, wary of secondary perils and high-frequency losses, have reduced the ILS capacity available to underwrite risk layers, and are more likely to aggregate deals that cover a sequence of events. This retrenchment has occurred most notably in collateralized reinsurance, reducing the availability of retrocession capacity in recent renewals. In contrast, catastrophe bond issuance has been strong since 2020 (see chart 3). Most catastrophe bond issuers in the past 12 months were repeat issuers, such as Everest Re, SCOR, Pool Re, and Swiss Re, but we have also seen some first-time issuers such as Peak Re, Toa Re, and China Re.

Chart 3

Three Characteristics Of The ILS Market

It is a buyers' market

Future returns on ILS look better than they were prior to 2017. Catastrophe bond multiples--that is, the price per unit of risk assumed--have been increasing, making such bonds more attractive for investors. At the same time, investors remain firm about their return expectations. According to Artemis.bm, a provider of news, analysis, and data on the ILS market, the average change between the guidance and final price in catastrophe bond placements in second-quarter 2022 was 10.6% (see chart 4). This is particularly high, as usually the change is either negative or much smaller, and reflects the harder price environment. Furthermore, some recent deals failed to be placed at all, highlighting the ILS market's firm stance on minimum return expectations.

Chart 4

Negotiations are not only becoming harder in terms of pricing, but also in reference to terms and conditions. Retentions by cedants have increased and certain perils have been excluded. This is evident from data from our cohort of the top 21 global reinsurers. Cedants used 50.0% of ILS capital as part of their reinsurance program in 2021, slightly down from 51.3% last year (see chart 5). The reduction in risks ceded to ILS is most pronounced for the large global reinsurers. This is due to reinsurers' retention of more risks on their own books in the current hardening pricing environment and the reduction in the retrocession capacity available. For midsize global and other reinsurers, usage of ILS has gone up. This could, among other things, be due to higher premiums written because of rate increases and inflation, and less capacity at the global reinsurers, prompting smaller players to turn to the ILS market.

Chart 5

In addition, deals have been structured to allow for adjustments for inflation, another topic of concern for the ILS market. For example, Everest Re's recent Kilimanjaro III Re catastrophe bond issuance introduced an inflation adjustment factor such that if inflation exceeds a certain percentage, the attachment point--the point at which (re)insurance limits apply--will increase accordingly. Other deals have moved away from providing protection for actual loss adjustment expenses.

It is dominated by natural catastrophe risks

In the first quarter of 2022, more than half of ILS deals covered international and multiple U.S. perils, according to Artemis.bm. Most other deals have focused on U.S. hurricanes, floods, and medical benefit claims. There are only a few perils that ILS cover that are not linked to natural catastrophes (see chart 6).

Chart 6

Its correlation with the broader financial markets is low

In a recent selloff of financial assets driven by inflation concerns, interest rate hikes, and the Russia-Ukraine conflict, the markets for many of these types of assets, such as equity and bonds, have seen severe downturns. ILS behave differently to such assets as they have less exposure to interest rate duration risk than traditional bond instruments. Most ILS have a component of their performance linked to a benchmark rate, reducing the interest rate risk for investors. Furthermore, ILS' cash flow streams are tied to actuarial risk, the risk that the actuarial assumptions underpinning the price of a policy may prove wrong. This risk is commonly associated with specific natural disasters.

At a time of high market volatility for other asset classes, ILS has allowed investors to obtain liquidity by selling their ILS without realizing losses. This has led to a reduction in investors' assets under management, as they turned to ILS to meet their liquidity needs and avoid crystallizing investment losses. If losses are within investors' expectations this hurricane season, and pricing continues to harden, we could see more ILS capital become available. This could happen if we see the market broaden beyond insurance cedants to, for example, corporate companies or property investment funds, or if the market moved into new perils, such as cyber. However, cyber risks could have a closer correlation with the financial markets.

The Cyber Insurance Market Lacks Capacity

The demand for cyber insurance outstrips the existing capacity. Awareness of cyber risk is increasing, and cyber insurance is becoming an important risk management tool, not only for larger corporates, but also for small-to-midsize enterprises and even retail customers. At the same time, capital across the entire cyber insurance value chain is becoming limited and (re)insurers remain cautious about taking on this type of risk (see "Cyber Risk In A New Era: Reinsurers Could Unlock The Cyber Insurance Market," published Sept. 29, 2021).

Insurers of cyber risk are providing the same or less coverage for a higher price due to the potential for huge accumulation losses and the extreme increase in ransomware and business interruption claims in 2020 and 2021. The volatility within the cyber insurance segment and the evolution of new types of cyber attacks make solutions for the emerging risks key factors in the market's development (see "Cyber Risk In A New Era: The Rocky Road To A Mature Cyber Insurance Market," published July 26, 2022).

Cyber insurance premiums topped $9 billion in 2021, according to Munich Re. We assume that the figure is likely to increase at an average 25% per year to about $22.5 billion by 2025. That forecast growth might seem to be a sign of a burgeoning cyber insurance market, but we expect that the smaller part of the increase in total premiums will result from greater capacity to write policies, or from a significant increase in the size of insurance contracts. We believe that the larger part is likely to come from a significant increase in rates, driven by a supply and demand mismatch and insurers' cautiousness in taking on new risk. Still, cyber insurance is the fastest growing line of business today and in our base-case assumption for the coming years (see chart 7).

Chart 7

The Cyber ILS Market Is Still In Its Infancy

A more mature retrocession and ILS market could increase the capacity and support the growth of the cyber insurance market, and lead to better returns on capital because of efficient capital management further down the (re)insurance chain. This is reminiscent of ILS' origins in response to a shortage of (re)insurance capacity from private and public sources for natural catastrophe risks following Hurricane Andrew, which struck the Bahamas, Florida, and Louisiana in 1992.

Despite making some cautious steps in the maturing cyber (re)insurance market, so far, the ILS market has not shown much interest in providing additional capacity. However, if the primary market grows at pace, there may be potential for passing cyber risk on to reinsurers and retrocessionaires, and potentially to the alternative capital market (see "Cyber Risk In A New Era: Reinsurers Could Unlock The Cyber Insurance Market," published Sept. 29, 2021).

Currently, there are no affirmative (explicit) cyber catastrophe bonds or sidecars outstanding, but there have been some small cyber-related ILS transactions in the form of collateralized reinsurance from some of the Bermuda-based ILS carriers. Furthermore, non-affirmative or silent cyber risk exposures already exist in ILS transactions, as cyber events can lead to claims in other lines of business, such as property and liability insurance (see "Cyber Risk In A New Era: Let's Not Be Quiet About Insurers' Exposure To Silent Cyber," published March 2, 2021).

According to PCS, a Verisk business and provider of catastrophe data, around 90% of ILS fund managers are concerned about the potential for silent cyber exposure within their funds. Since silent cyber claims can have a detrimental impact on other insurance lines of business, ILS funds with exposure to operational or property risk already carry the costs of silent cyber risk. The question is, are ILS investors sufficiently rewarded for that risk, and was their intention to expose themselves to cyber risk in the first place?

ILS structures focusing on clearly defined cyber events would help to separate cyber from property risks. A clear separation would not directly solve the issue of silent cyber, but it would further highlight the need for clear and robust cyber risk exclusions further down the (re)insurance value chain to prevent silent cyber claims. Furthermore, it could encourage clearer inclusions and exclusions of perils within cyber insurance contracts, thereby improving transparency, potentially for ILS investors as well.

Cyber Risks Disincentivize More Than Incentivize ILS Investors

The strong growth rates in the cyber insurance market might prompt ILS asset managers to consider cyber risk when evaluating new opportunities for expansion. Institutional investors seek portfolio diversification, while the insurance industry is seeking additional capacity. Furthermore, cyber risks are fairly new as underlying risks, and could improve diversification for investors focusing on first-party cyber risks, like forensic costs, crisis communication, and business interruption, and third-party cyber risks like data breaches, network interruption, and media liability. Further incentives are the underlying industry growth; rate hardening and improvements in profitability; potential diversification benefits; a lack of correlation with most other underlying ILS risks, such as natural catastrophes; and improved modeling capabilities and risk awareness over the past two years (see table 1).

However, we believe that disincentives currently outweigh incentives for ILS investors when it comes to cyber risks. Cyber insurance is a more capital-intensive line of business than pure property-catastrophe insurance, since the third-party risk implies a longer tail. Further key challenges are potential accumulation risks and interrelated losses, and the complexity and heterogeneity of insured perils. The accumulation of claims within a cyber insurance portfolio can expose an insurer to high financial losses. A severe natural catastrophe can also affect many countries, but is usually limited to a certain region. Cyber risks are not limited by region and can easily spread across the globe in a few seconds. As evident from attacks like NotPetya and WannaCry, there is significant accumulation potential due to increasing digital interconnectivity and interfaces along multiple supply chains.

In addition, the cyber market's initial focus was on capacity in proportional reinsurance, instead of excess-of-loss reinsurance structures, which ILS investors appear to prefer. Cyber excess-of-loss reinsurance contracts are still in a build-up phase, but most contracts written are on a risk-attaching basis. This is not attractive to ILS investors, as losses on those underlying contracts are ceded to the reinsurer, regardless of when they occur. As a result, exposure is not confined to the period of the contract and could last multiple years. But the recent move to claims-made structures, which shorten the tail of the exposure to a year, could make cyber insurance more interesting for ILS investors.

Table 1

Cyber risks could have a positive correlation with the financial markets

Data breaches may weaken equity prices and widen credit default swap spreads in the short term, increasing the link between cyber events and the financial markets. In a study in 2020, we analyzed the impact of cyberattacks (data breaches) from 2007 to 2019 for 32 rated companies from the technology, financial institution, and corporate sectors for a total of 41 events (see "Cyber Risk In A New Era: Recent Cyber Events And Impact On Company Financials," published Oct. 23, 2020). A key conclusion was that the data breaches did not have a lasting effect on revenue and EBITDA, as there was no clear evidence of declines in quarterly revenue attributed to the data breaches. However, most data events did cause a drop in equity prices after the event had been reported in the news, although they rebounded and normalized in subsequent weeks (see chart 8).

Chart 8

Some data breach events caused a rise in credit default swap spreads after the event was reported, normalizing in subsequent weeks (see chart 9).

Chart 9

However, our study only covered cyber events involving data breaches. An additional key risk we did not analyze was accumulation risk, as cyber risks can easily spread across the globe. Hackers exploit systemic weaknesses in digital business systems, and cybersecurity approaches need to recognize this to plan for the catastrophic repercussions and increased threats to critical infrastructure.

ILS with exposure to underlying natural disaster risk offer diversification and real returns that are mostly independent of the capital markets. This gives them a clearer diversification profile and shorter tail. In contrast, a big cyber event could trigger a decline or volatility in stock and bond market values, increasing the correlation with the capital markets.

Industry Loss Warranties Could Be A Good Entry Point

Rather than increasing their commitment to cyber, primary insurers are decreasing their own retention levels by ceding higher shares to reinsurers. We assume that primary insurers cede about 45%-55% of cyber insurance premium to reinsurers, up from about 35%-45% roughly a year ago. This underscores the importance of the reinsurance industry providing cyber capacity. Ongoing improvements in the definition of insured cyber-event triggers and the language used for the terms and conditions, as well as recent moves to claims-made structures that shorten the tail of the exposure, might increasingly motivate (re)insurers to access alternative forms of capital. Given the underlying systemic nature of cyber risk, scenario modeling will be key for investors when taking on cyber insurance underwriting risks. Leading insurers in the field of cyber insurance and modeling agencies like PCS, Kovrr, DeNexus, and Cyber Cube play an important role and strive to continuously improve their modeling capabilities.

We see an opportunity for the ILS sector to be the first to focus on ILW products using industrywide estimates for each event, resulting in a cyber industry loss index trigger. Around 25% of the total current catastrophe bonds and ILS already have an industry loss index trigger. PCS provides such industry loss estimates for global cyber loss events and reports when a firm believes that an event is likely to cause more than $20 million in insured losses. Factors that PCS includes are "actual reported losses", "reserves that are set", and "any information on insured losses from announcements, news stories, regulatory filings, and conversations with industry stakeholders". Focusing more on ILWs using industry loss triggers would help investors to improve their understanding of cyber tail risk and could be an entry point for the ILS sector.

In view of the challenges mentioned above, cyber ILS transactions can be very complex, and complex transactions are likely to fail. A more simplified approach, starting with only one defined cyber peril, such as a cloud outage, a service provider outage, or an attack on critical infrastructure, instead of multi-peril agreements, will help investors better understand the underlying risk, and, as a result, quantify their risk exposure.

Chart 10

A parametric trigger is a predefined event--for example, a global cloud outage--that triggers the payment of a set amount according to a pre-agreed schedule. Such events can refer to an industry-based trigger with pre-agreed limits, paying out, for example 50% or 100% of an insured sum based on an independent and verifiable parameter without a lengthy claims settlement process. Recent improvements, especially for trigger mechanisms, increase the potential for ILS participation.

A Simpler Approach Could Increase ILS Investors' Appetite For Cyber Risk

One way of attracting ILS investors to the cyber insurance space could be to offer different underlying cyber risks that could improve the diversification profile of ILS funds. Another way could be to focus on simplified and affirmative cyber transactions with clear peril definitions, and establish ILW products that have a cyber industry loss index trigger. This more cautious approach would help investors improve their understanding of cyber tail risk. Having more entry points for investors and opportunities for (re)insurers to transfer specific and clearly defined risks to the capital market could help to sustain the cyber insurance value chain.

To date, the appetite among ILS investors for cyber risk is rather limited and varies heavily, according to feedback from ILS managers. Some investors have even said they have no appetite for cyber risks at all. That is mainly due to the substantial accumulation risk, the potential positive correlation between cyber attacks and the financial markets, and the complexity and heterogeneity of cyber risks. Furthermore, cyber modeling is still in its infancy, many years behind natural catastrophe modeling, and less reliable, although information about cyber-related claims and response strategies is growing. Consequently, in our view, the cyber ILS space will grow rather slowly and is likely to remain niche in the short-to-medium term.

Related Research

• Cyber Risk In A New Era: The Rocky Road To A Mature Cyber Insurance Market, July 26, 2022
• Cyber Risk In A New Era: Reinsurers Could Unlock The Cyber Insurance Market, Sept. 29, 2021
• Cyber Risk In A New Era: Let's Not Be Quiet About Insurers' Exposure To Silent Cyber, March 2, 2021