S&P Global Ratings has warned limited cyber underwriting capacity looms as the biggest hurdle to the growth of the market, which is seeing increased demand in response to worsening digital threats.

Prices could rise sharply between now and 2023, doubling from current levels in some cases, the rating agency says in a new report.

“There is a significant demand for cyber coverage and we expect this business line to be one of the fastest growing insurance markets over the next decade,” S&P said. “That said, the market faces increasing demand and limited supply.

“The biggest risk to the development of a sustainable cyber re/insurance market is that capacity remains constrained.

“We are currently seeing undersupply in certain areas of reinsurance, retrocession, and alternative capital.”

S&P says the pandemic has accelerated the pace of digitalisation in the way the world shops, learns and works, changing the shape of the cyber risk landscape. These trends are set to stay, inevitably leading to a higher likelihood of cyber incidents.

At the same time COVID-19 exacerbated the huge cyber reinsurance protection gap by causing existing and new clients to request larger limits and more inclusions in their policy terms and conditions.

The boom in digitalisation has led to a substantial pick-up in cyber losses for the re/insurance industry.

“As losses multiple, rates ramp up,” S&P said. “This was mainly attributed to the growing frequency and severity of ransomware and social engineering claims.

“These include claims for business interruption, rising incident response costs, and extortion demands.”

S&P says to sustain long-term profitability, it anticipates that insurers will continue to restructure their cyber insurance offerings by increasing rates further and adjusting their terms and conditions, particularly the exclusions.

But it believes there are other solutions worth considering.

“In our opinion, the cyber re/insurance market would benefit from the evolution of a more comprehensive retrocession and [insurance-linked securitisation] market in the next few years, supported by government risk pools,” the rating agency said.

“We see these steps as necessary to speeding up the expansion of capacity.”

It cites the Singapore government’s setting up of a commercial cyber risk pool as a model that other jurisdictions could consider emulating. The pool brings together traditional insurance and the insurance-linked securitisation market to bolster capacity.

“In our opinion, this innovative and forward-looking solution offers a model that could be repeated in other markets,” S&P said.

“Furthermore, such pools could support more risk-adequate pricing and underwriting through their increased focus on analytics and modeling.

“This may enable the provision of larger insurance limits and fewer exclusions within cyber insurance for policyholders.”