By Michael Loney

June 23 - (The Insurer) - Last year marked the first ever decrease in U.S. cyber insurance premiums since data was first collected on the sector by the National Association of Insurance Commissioners in 2015, according to a new AM Best report.

Premiums generated from cyber insurance coverage declined by 2.3% to $7.08 billion in 2024, down from $7.24 billion in 2023.

However, the loss ratio for the U.S. cyber segment remained below the 50% mark in 2024, which AM Best said suggests that the line is still profitable for those who choose to underwrite the risk.

The decrease in premiums last year was driven more by pricing changes than any changes in exposure, it added.

“The premium decline was nearly identical to the year-over-year decline in pricing, indicating there was little change in cyber risk exposure from 2023 to 2024,” the report said. “With an increase in claims accompanying the drop in premium, the loss ratio, including defense and cost containment $(DCC.UK)$ expenses, did increase.”

The cyber loss and DCC ratio increased to 48.8% in 2024, from 41.6% in 2023, but was still significantly below the ratios in the mid-60s in 2020 and 2021.

“When premium grew during the hard market cycle, the growth significantly outpaced the pricing increases, indicating that demand for cyber insurance was increasing as well,” the report said. “That the premium decrease is close to the pricing decrease indicates that the demand for cyber insurance is steady.”

AM Best said that the premium decrease could also point to some large organisations switching to insuring their cyber exposure through their own single-parent captive insurers, which allows them to keep the benefit of their own good experience.

These captives do not typically file with the NAIC, and such information is not available in the cyber supplement, the rating agency said.

The report also showed that the top insurers by premium and policy count have remained unchanged for several years.

Chubb remains the top insurer by premium despite a small decrease from 2023 of 2.3%, which matched the industry total. The insurer had $560.3 million of cyber direct written premiums in 2023, giving it a 7.9% market share.

Eighteen of the top 20 insurers by 2024 premium were also in the top 20 the previous year.

By policy count, The Hartford Insurance Group is dominant, with more than double the number of policies of any other cyber insurance writer.

“The top four writers by policy count all write mostly by endorsement, which is a high-volume, low-premium policy setup. Cyber coverage by endorsement of another commercial policy is common for SMEs,” the report said.

CLAIMS UP IN 2024

AM Best also highlighted that claims increased significantly in 2024, with first-party claims representing about 75% of the total.

“Ransomware attacks began accelerating about five years ago, and data for traditional actuarial analysis in the form of early development patterns is now becoming available. We believe there is still a tail on these losses, as litigation and discovery could be more protracted and hacks could be latent for a long time before they are exploited,” the report said.

The rating agency also suggested that increased litigation could lead to a longer tail on the business, even the first-party claims. This would make claims more expensive both in the cost of the claim through more inflation as well as the cost of litigation.

In addition, third-party risk is becoming more complicated for insurers.

“Clients have exposure to cyber not just through their own business, but also through their vendors. Subrogating against a vendor when the vendor’s action causes the loss also proves difficult,” the report said.

“The vendor may not have assets to make a case worthwhile to the insurer. Also, subrogation risks fracturing the insured’s relationship with the vendor. Part of a good cyber hygiene strategy should include due diligence on third-party vendors and anticipation of such scenarios.”

The NAIC overhauled its cyber supplement to the annual statement for 2024 filings. It changed from a two-way standalone/packaged split to a three-way primary/excess/endorsement split.

“The change in wording from the NAIC is now a clear distinction between policies covering only cyber versus policies for which cyber is an endorsement to another policy. The result is a better picture as to what types of policies are being issued and the premium paid for cyber coverage,” AM Best said.