Cyber risk and cyber insurance

The most useful split for the actuary separates the insured's own costs (first party) from its liability to others (third party). First party resembles property insurance with business interruption; third party resembles liability insurance with long development and litigation. A single intrusion often triggers both: ransomware halts operations (first party) and also exposes customer data, whose owners then file claims (third party).

Recent experience points to ransomware as the main source of losses. According to Munich Re's 2025 report, business interruption accounted for 51% of the costs of ransomware events, and manufacturing had the largest share of such claims, followed by healthcare. The average cost of a data breach reached a record 4.9 million dollars.

A stand-alone cyber policy bundles sections with their own limits and deductibles, almost always under an annual aggregate limit. To model it, one must understand that each section has a different distribution: incident response is frequent and moderate, business interruption depends on a time threshold, and third-party liability arrives years after the event.

Cyber coverage also shows up, sometimes unintentionally, in traditional fire, liability or surety policies that do not expressly exclude cyber events. That silent cyber risk is a source of unpriced accumulation, which is why the market has been adopting clauses that affirm or exclude cyber coverage across all lines.

A cyber accumulation occurs when a single cause affects many insureds at once. Typical sources are a common vulnerability in widely used software, a cloud provider outage, malware that spreads uncontrollably and the technology supply chain. Unlike an earthquake, the accumulation has no epicenter: exposure is defined by technology dependencies, which almost never appear in underwriting information.

CrowdStrike, July 19, 2024. A faulty content update to CrowdStrike's security software left Windows computers inoperable around the world. Microsoft estimated about 8.5 million affected devices, less than 1% of Windows machines, but concentrated in airlines, banks, hospitals and services. It was not an attack: it was a system failure. Insured loss estimates varied by model: Guy Carpenter put it between 300 million and 1,000 million dollars, CyberCube between 400 million and 1,500 million for the stand-alone cyber market, and Parametrix calculated that US Fortune 500 companies (excluding Microsoft) would suffer direct losses of about 5,400 million, of which only 10% to 20% would be insured because of high retentions and low limits.

NotPetya, 2017. Destructive malware that the White House attributed to Russian action against Ukraine and that spread far beyond its target. Merck claimed about 1,400 million dollars from its property insurers (all risks policies) for more than 40,000 disabled machines. The insurers invoked the hostile or warlike action exclusion; on May 1, 2023, the New Jersey appellate court ruled that the exclusion did not apply because it requires the involvement of military action, and the parties reached a confidential settlement in early 2024. Mondelez, which sued Zurich for about 100 million over the same event, also settled in 2022.

The two cases teach different lessons. CrowdStrike showed that a non-malicious failure can produce the largest event of the year and that the business interruption waiting period determines how much the market pays. NotPetya showed that policies that do not mention cyber risk can end up paying for it and that the wording of war exclusions matters as much as the model.

Traditional war exclusions were written with armies and bombings in mind. The Merck case made clear that, without specific wording, a court may refuse to extend them to a cyberattack attributed to a State. The Lloyd's market responded in two steps.

On November 25, 2021, the Lloyd's Market Association (LMA) published four model clauses, LMA5564 through LMA5567. Number 1 is titled war, cyber war and cyber operation, and it is the simplest: it excludes loss arising directly or indirectly from a war or a cyber operation. Numbers 2 to 4 introduce the term limited cyber operation and offer different levels of coverage for State operations that fall short of war. All of them share the concept of a major detrimental impact on an essential service of a State.

On August 16, 2022, Lloyd's issued market bulletin Y5381, which requires its syndicates to ensure that stand-alone cyber policies exclude losses from State-backed cyberattacks and have a robust basis for attributing them, applicable to every policy incepting or renewing on or after March 31, 2023. In January 2023 the LMA replaced the original clauses with eight versions (LMA5564A and B through LMA5567A and B). The A versions include an agreed method for attributing the operation to a State and comply with the bulletin; the B versions omit attribution and require prior approval from Lloyd's. The new wording defines war as an armed conflict between States involving the use of physical force.

The starting point is the collective model: a random number of claims per year and a random severity for each. In cyber, frequency usually shows overdispersion (the variance exceeds the mean) because of heterogeneity among insureds and waves of attack campaigns, so the Poisson is a starting point and the negative binomial a natural improvement. Severity needs heavy tails: the lognormal works well in the body of the distribution and the Pareto better describes claims above a high threshold.

The quantities that matter for the premium are not those of the gross loss but those of the layer the policy pays: the amount above the deductible and up to the limit. For that we use the limited expected value, which has a closed form for the lognormal. The same tool appears in loss functions and in reinsurance layer analysis.

Cyber claims data cover few years, mix very different policy wordings and reflect technology that has already changed. A 2019 claim says little about today's double extortion ransomware, and observed frequency depends on the maturity of the insured's controls, which have also changed. Fitting a distribution to that history and extrapolating to a 200-year return period is, at best, an informed guess.

That is why practice combines three sources. First, exposure models that estimate frequency and severity from insured characteristics (revenue, sector, number of records, vendor dependencies). Second, deterministic accumulation scenarios: a cloud provider outage lasting a certain number of hours, mass ransomware on an operating system, a security software failure. Third, probabilistic models from specialist vendors such as CyberCube, whose estimates were used for the CrowdStrike event and as the risk model for Beazley's Cairney bond. For market indices, PERILS publishes US cyber industry insured losses that already serve as a bond trigger.

With scarce data, credibility theory makes it possible to blend own experience with market assumptions transparently. And parameter uncertainty is best treated as one more risk: two reasonable models can differ by a factor of five in the 200-year return period loss, as the ranges published after CrowdStrike showed.

A cyber rate starts from a base premium by size (revenue) and sector, and adjusts it with factors that reflect the insured's security hygiene. What is new compared with other lines is that those factors can be verified from the outside: external scans reveal exposed ports, expired certificates or unpatched software, and the insurer can require minimum controls as a condition of underwriting.

Controls act on different components. Multifactor authentication and patch management reduce frequency; tested offline backups reduce ransomware severity because they shorten the interruption and weaken extortion; a rehearsed response plan reduces first-party costs. Separating the effect on frequency and severity makes it possible to price with GLM relativities rather than arbitrary discounts.

The pricing cycle also matters. After the 2020 to 2022 increases, Howden reported that global cyber rates were 22% below their mid-2022 peak and that market revenue growth slowed to 6% a year between 2022 and 2024. A soft market with better controls can be profitable; a soft market that relaxes requirements repeats the mistake of the previous cycle.

Cyber insurance relies heavily on reinsurance. The dominant form has been quota share, which shares premiums and losses proportionally and allows the cedent to grow without consuming as much capital. Accumulation protection is bought through per event or aggregate excess of loss covers, whose weak point is the event definition: when are two intrusions with the same malware a single event?

Since 2023 cyber risk has reached the capital markets. In January 2023 Beazley placed Cairney, a 45 million dollar private bond with an indemnity trigger that protects above a 300 million event. AXIS sponsored Long Walk Re 2023-1, described as the first cyber catastrophe bond placed under Rule 144A, for 75 million dollars, with a per occurrence indemnity trigger and a 510 million attachment point. In December 2023 Swiss Re issued Matterhorn Re 2023-1 for 50 million, the first with an industry loss trigger based on PERILS data. In January 2024 Beazley closed PoleStar Re 2024-1, at 140 million, its first 144A bond.

For an investor, the appeal is a high premium for a risk with little correlation to earthquakes and hurricanes. For the actuary, each structure raises a different question: with indemnity, how much of the cedent's underwriting risk does the investor take on; with an industry index, how much basis risk does the cedent take on.

The Ley de Instituciones de Seguros y de Fianzas (LISF, Insurance and Surety Institutions Law) has no cyber line: its article 25 lists the lines within the property and casualty operation (liability and professional risks, fire, miscellaneous, among others), and cyber insurance is structured as a product within that operation, supported, like any product, by a technical note, contractual documentation and a consistency opinion (article 201). Because industry statistics are organized by those lines, cyber-specific information is scarce and hard to compare across companies, unlike auto or medical expense. Whoever builds the technical note depends on the company's own experience, reinsurance and international benchmarks adjusted to the local market.

The data protection framework changed in 2025. On March 20, 2025, a new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, Federal Law on the Protection of Personal Data Held by Private Parties) was published in the DOF (Official Gazette), in force from the following day, replacing the 2010 law and transferring the functions of the defunct INAI to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance). The law requires every data controller to maintain administrative, technical and physical security measures (article 18) and to inform data subjects immediately of security breaches that significantly affect their property or moral rights (article 19). Fines under article 59 range from 100 to 160,000 or from 200 to 320,000 times the UMA (Unidad de Medida y Actualización, the official reference unit) depending on the violation, and may be doubled for sensitive data. These obligations define a large part of the response costs and third-party liability that a policy covers.

Insurers themselves must manage their technology risk. The Circular Única de Seguros y Fianzas (CUSF, Single Insurance and Surety Circular) requires the internal control system to preserve the security of the information generated, received, transmitted, processed or stored in their systems (Provision 3.3.3, section VI) and requires policies for outsourcing services to third parties to maintain the confidentiality and security of information and to provide for continuity plans (Provision 3.6.3). For transactions through electronic means, Chapter 4.10 calls for mechanisms to detect and prevent events that affect the confidentiality, integrity and availability of information, for reporting incidents to the audit committee and for response procedures under the responsibility of the chief executive officer (Provisions 4.10.23 to 4.10.26). No regulator is immune: on January 30, 2026, the CNSF (National Insurance and Surety Commission) itself reported an information security incident that exposed data from intermediaries' license records.

In December 2024, as part of its Actuarial Monitoring Scheme, the Institute and Faculty of Actuaries published the thematic review Actuaries managing cyber risk, which describes how actuaries take part in managing operational cyber risk and in designing coverages, with examples of collaboration with security specialists. It is useful reading for understanding the professional role beyond the model.