Cyber remains a difficult risk to model and price, forcing reinsurers to manage their exposures through appetite, pricing, tighter wordings and exclusions, according to a Gallagher Re report. 

Unlike natural catastrophes such as floods, the industry has yet to come to a universal consensus on a definition for a cyber disaster. 

“When considering the risk of cyber cat, the biggest problem for the industry is that we’ve never really experienced one,” the report says. 

“Because there has never been a truly systemic cyber disaster, there is no universally accepted definition for what might cause one and what form it might take – and no industry consensus on modelling the risks.” 

The report, titled The Risk of a Cyber Catastrophe, says cyber modelling remains in its infancy despite growing demand for cover. 

“Model providers are investing in improving their capabilities, but the (re)insurance industry will require more and better data from insured clients on their cyber vulnerabilities and loss experience to improve models – and hence – pricing,” the report says. 

The report says a shared understanding of what a cyber catastrophe could look like would be a useful starting point. 

“This, in turn, needs to be translated into consistent claims reporting frameworks.” 

The 2017 NotPetya ransomware attack is “arguably” the closest the world has come to a systemic cyber event and forms the foundation of many of today’s cyber models, according to the report. 

Iain Willis, Research Director at the Gallagher Research Centre (GRC), sees the need for further development of the models as a critical factor for capturing and understanding cyber risks. 

“Models that can capture a risk more precisely allow for the development of products and pragmatic pricing. The old adage that ‘models make markets’ tends to ring true,” Mr Willis said.  

“The concern currently would be that the divergence of existing model output shows the wide range of uncertainty in this peril. This is where research can really help.”