U.S. private cyber insurance market capable of managing most risks: study

The private cyber insurance market in the United States is capable of managing most risks, according to a new policy study from Washington, D.C.-based think tank R Street Institute.

Released on Thursday, the study from R Street senior fellow Ian Adams found that the market is growing at a rate of 26% to 50% per year. The U.S. insurance industry collected US$2.75 billion in cyber insurance premiums in 2015, a total that is expected to grow to US$7.5 billion by 2020. Overall industry capacity is currently estimated to be about US$500 million, R Street said in a press release.

“Encouragingly, to date, policies with US$50 million limits would be able to cover roughly 92 per cent of cyber-event claims,” Adams wrote in the report, titled The Promise and Limits of Private Cyber Insurance.

However, the study acknowledges that some models place the likelihood of a major cyber event that causes between US$250 billion and US$1 trillion in damage at some point in the next decade to be between 10 and 20 per cent. Given the potential for this sort of “black swan” event, some have proposed a government backstop or reinsurance facility to manage the nation’s cyber exposure.

Adams warns policymakers to be cautious about any plan that could dampen development of private solutions or displace private coverage, “particularly given the tendency of government insurance programs to inculcate moral hazard, channel funds through inefficient and unpredictable processes, and unnecessarily delay recovery.”

“Policymakers must proceed with extreme caution when it comes to any proposal to create a new government backstop or facility to manage cyber insurance risks,” Adams wrote. “Overzealous efforts to correct a presumed market ‘failure’ that has not, as yet, presented itself threaten to strangle the nascent industry of private cyber insurance while it’s still in the cradle.”

Adams went on to say that “what can be assessed for certain is that the cyber insurance market is growing rapidly and that it already has sufficient capacity to cover the overwhelming bulk of events the market already has faced. It is also the case that businesses report they are satisfied with their existing cyber coverages. Unlike in the case of terrorism in the early 2000s, there is no evidence that insureds are requesting coverage limits that insurers and/or reinsurers have been unable or unwilling to fulfill.”