Bermuda goes deeper into cyber space

An undisputed and longstanding hub for property and casualty (P&C) reinsurance business, Bermuda has been attracting attention for its growing expertise in cyber risk.

Still regarded as a specialty line in the Bermuda market, cyber accounted for less than 3% of gross written premium (GWP) for all lines in 2021. But the pace of growth is rapid.

According to the Bermuda Monetary Authority, commercial insurers produced total cyber GWP of $4.73bn in 2021, a year-on-year increase of nearly 58%. Cyber net written premium increased 70% to $3.33bn, the regulator said in its newly published Bermuda Cyber Underwriting Report 2022.

A talking point now is whether Bermuda carriers want to take advantage of the state-backed cyber attack requirements recently introduced by Lloyd’s to write more business.

LMA's exclusions

There appears to be a contrast between the traditional and the new carriers in whether they see Lloyd’s recently introduced cyber war requirements as a potential shot in the arm for the Bermuda market.

From March 31, syndicates are required to exclude liability for losses arising from any state-backed cyber attack from standalone cyber policies.

Shawn Ram, head of insurance at Coalition, a US-based managing general agent (MGA), says Bermuda has an opportunity to take advantage of the bifurcation in the cyber market between those carriers that adhere to the cyber war requirements introduced by Lloyd’s, including the model exclusion drafted by the Lloyd's Market Association, and those that choose not to.

Coalition has offered excess-of-loss cyber products in the US since 2020 and in Canada since 2021. In September 2022, it launched in the UK and, the following month, it announced the formation of Ferian Re, an independent Bermuda-based reinsurer that provides capacity across Coalition’s cyber programmes.

“The decision to utilise Lloyd's-related language is one that Coalition and Ferian Re can make. We can customise our language based on geography,” Ram says.

‘The Bermuda cyber marketplace is well-poised to lead in creating innovative insurance solutions and products that affirmatively cover cyber war. Modernisations in underwriting, including inside-out scans and real-time data capture, will allow for comfort around the accumulation exposure presented by cyber war’

^{Yosha DeLong, Mosaic}

Capitalised with about $300m from an investor group led by funds managed by BDT Capital Partners, Ferian Re can provide capacity across many product lines, Ram says, while the opportunity in cyber is currently focused on Coalition.

“For some markets, using a Lloyd's compliant exclusion is the advantageous option because it’s adopted as the language of choice since it’s an ‘opt-in’ selection, and the excess markets want to follow primary markets that utilise that language,” Ram says.

“Coalition spends most of our time in the primary markets. So, you want to have language that excess carriers can follow. Coalition has the flexibility to address the language that is conducive to the market.”

Mosaic Insurance, which industry veterans Mitch Blaser and Mark Wheeler launched in Bermuda in early 2021, is looking to grow its cyber portfolio.

Yosha DeLong, global head of cyber at Mosaic, says Bermuda can offer products that cover cyber war risks, adding the new cyber war exclusions are intended to add clarity and contract certainty to the cyber market.

“Implementation and adoption of this exclusion will allow for better understanding of accumulation risk and will open additional re/insurance capacity,” DeLong says.

Yosha Delong, global head of cyber, Mosaic Insurance

“In addition, the Bermuda cyber marketplace is well-poised to lead in creating innovative insurance solutions and products that affirmatively cover cyber war. Modernisations in underwriting, including inside-out scans and real-time data capture, will allow for comfort around the accumulation exposure presented by cyber war.”

Donavan Burgess, senior vice-president and underwriter for digital assets, cyber and professional lines at Relm Insurance, says the industry has adopted an “agile approach” in supporting programmes that employ different types of war wording. Relm is the first regulated crypto insurer to hold Bermuda’s Innovative Insurer General Business licence.

Primary insurers based in Bermuda are not restricted by the decisions or choices made by Lloyd’s in crafting their war restrictions, Burgess stresses.

“This places us in an advantageous position to continue to provide high-value and tailored cyber risk transfer products to our partnered clients who may, or may not, prefer a Lloyd’s-based wording,” he says.

“Unlike jurisdictions confined by the mandates of the US or the UK, Bermuda’s adaptability and flexibility allow us to fill gaps and meet the needs of clients in a superior manner and set us apart as an advantageous jurisdiction to place insurance,” Burgess adds.

He says: “It is not uncommon to come across programmes that incorporate staggered acceptance of war wording. For instance, a primary insurer may utilise one form of war wording, while one or two layers above may adopt Lloyd’s war wording. And then, above this layer and within the Bermuda layer, there is flexibility in choosing whether to follow Lloyd’s wording or align with the preferred wording of the primary carrier.”

The head of underwriting at a Bermuda-based cyber specialist, who spoke to Insurance Day on condition of anonymity, says the island has been able to take advantage of the exclusion.

“New opportunities have surfaced in Bermuda due to the Lloyd's exclusions and we know cedants who have reduced their Lloyd’s share to increase [it] in Bermuda,” he says.

Noel Pearman, senior vice-president and cyber product line leader at Axa XL, suggests the opportunities for Bermuda to take advantage of cyber war coverage inconsistencies may be limited.

The Lloyd’s cyber requirements are designed to address “legitimate and important” issues that can potentially threaten the cyber market’s viability, he says.

Noel Pearman, senior vice-president and cyber product line leader, Axa XL

“In a competitive market, the next questions are how and when do we address the issues. While the Lloyd’s market moved first with its clarification language, it is leading to better clarity in the entire market and I suspect that any friction, inconsistency, or dislocation will be short-lived,” Pearman says.

He continues: “Cyber risk is a global peril. I work closely with a very smart set of underwriters in our London team, and our global underwriting office ensures consistency across our geographic regions.

“Our teams globally play to our strengths, provide solutions for the varied opportunities that exist in our separate markets and cultivate a ‘you win, we all win’ mentality. With this model, regional discrepancies around critical issues are eliminated.”

Most of Bermuda’s clients are Fortune 500/1000 insureds and many of the carriers on the island are part of global re/insurance groups. However, the cyber market has attracted new types of carriers to Bermuda, including MGAs, cyber specialists and disruptive technology experts.

Diverse carriers

At the company level, it is difficult to ascertain how much cyber business Bermuda is writing each year, says Mosaic Insurance’s head of cyber, George Cole.

“On the direct side, we estimate around $120m. Reinsurance premiums are significantly higher, at about $3bn GWP,” Cole says, adding that Mosaic is targeting 20% to 25% GWP growth in its own cyber book this year.

Cole continues: “Traditionally, the Bermuda market writes large US and European corporates. However, the hard market during 2021 and 2022 saw a new flow of mid-market accounts to Bermuda, due to clients being unable to obtain favourable terms domestically.”

The traditional players are, however, very much the larger part of the increasingly diverse mix of Bermuda’s cyber insurers. Their experience means they are less inclined to distraction.

‘While the Lloyd’s market moved first with its clarification language, it is leading to better clarity in the entire market and I suspect that any friction, inconsistency, or dislocation will be short-lived’ 

^{Noel Pearman, Axa XL}

Axa XL’s Pearman says that, although ransomware “doesn’t dominate the news cycle” as it once did, it remains a top threat for clients.

“Contrary to popular opinion, ransomware hasn’t gone away. This is one of the dangers of ‘underwriting by headline’. That said, the cyber liability underwriting around ransomware has matured significantly and our clients’ controls and countermeasures have markedly improved. On the other side, threat actors have access to better tools than ever, so vigilance remains the order of the day.”

Most of the major reinsurers on the island already participate in the cyber market. They represent close to 50% market share for cyber reinsurance, according to the cyber underwriting source. There is also new interest from insurance-linked securities markets, “which may constitute new capacity going forward”, the source adds.

He continues: “The cyber business Bermuda is underwriting is very well diversified between different reinsurance structures, composition of book and geography. Bermuda is market lead for excess-of-loss business, which constitutes the tail events, while it also has significant share of the proportional market which has SMEs [small and medium-sized enterprises], large cap, international, personal lines, etc.”

Growth prospects

Axa XL’s Pearman stresses Bermuda’s cyber insurance market has developed “responsibly”.

“The market is more diverse than ever, but its bread-and-butter remains large, complex, Fortune 500/1000 insureds. Many of the Bermuda carriers also write cyber out of their US and/or UK offices and, as a result, managing global aggregation on large risks is normal operating procedure,” he says.

Bermuda’s established underwriting culture “prioritises longevity and consistency” and those carriers who “provide value irrespective of the market cycles”.

Coalition’s Ram says there are “new capacities from every sector” entering Bermuda’s cyber market.

Donavan Burgess, senior vice-president, underwriter, digital assets, cyber and professional lines, Relm Insurance

“The nuance in Bermuda is that some of that capacity came from reinsurance carriers who brought in their appetite and were able to offer more capacity in reinsurance placements,” Ram says.

One of the “remarkable advantages” of the Bermuda market is its ability to offer capacity across the entire spectrum of risk transfer requirements, encompassing primary, low-excess and high-excess, according to Relm’s Burgess.

“Traditionally known as a high-excess go-to market, Bermuda has witnessed a transition in the last two to three years, with the emergence of highly credible primary and low-excess carriers who have made their mark in the industry,” he says.

On an insurance placement basis, Bermuda has the capability to build excess layers of up to $50m, Burgess says. “On the primary side, we’ve seen carriers deploy limits of up to $10m. Relm, in particular, can deploy up to $5m lines on a primary basis,” he adds.

'Unlike jurisdictions confined by the mandates of the US or the UK, Bermuda’s adaptability and flexibility allow us to fill gaps and meet the needs of clients in a superior manner and set us apart as an advantageous jurisdiction to place insurance'

^{Donavan Burgess, Relm}

Bermuda’s growth in cyber will, in large part, be thanks to this jurisdiction’s reputation for innovation, Burgess says.

For example, Bermuda has played a “pivotal role” in facilitating the trading of the world’s first cyber catastrophe bonds, and it is “well-positioned” to provide novel and bespoke cyber insurance for blockchain and artificial intelligence companies.

Pricing outlook

Cyber market cycles have been very short, Pearman says, “bringing surprises when the market was rapidly hardening and as it was stabilising”. Such a dynamic makes long-term forecasting a challenge.

He explains: “Large US corporates comprise the bulk of the Bermuda client base, complemented by mid-sized US-based companies and international companies of all sizes, and there is diversification in industry, size and region, but the Bermuda cyber market has been affected by increased competition, especially due to new US-based managing general agents, and increased pressure on higher excess pricing.

“With half of the year still left to go, we’ve yet to see if the market can add enough new business to fully offset that pricing pressure. It’s premature to make predictions at this point, but I remain hopeful.”

Mosaic’s Cole says cyber risk-adjusted rate change is -20% in 2023 to date, following negative rate movement in the fourth quarter of 2022. “We expect a flattening of pricing as we approach Q4 this year,” he says.

The cyber underwriting source says the cyber reinsurance pricing outlook is around a 10% rate increase in excess-of-loss, while there will be “flat-to-minor increases” in ceding commission in proportional business.

“We are noticing more clients embrace event coverage which shows the maturity of the market,” he says.