Hiscox Re goes behind the scenes of its cyber catastrophe consortium

Earlier this year, the re/insurance market welcomed a first-of-its-kind innovation in the formation of CyberShock, a cyber catastrophe consortium. Created by Hiscox Re & ILS and Ariel Re, the new entity looks to provide up to $50 million in per-program capacity to support cyber insurers globally, and foster a healthier and more sustainable cyber insurance ecosystem.

Discussing the consortium’s launch, Conor Husbands (pictured), senior underwriter, cyber, at Hiscox Re & ILS, noted that it found its roots in addressing a long-standing challenge facing the cyber marketplace.

“On the one hand, there’s increasing demand from clients, from cedents, to transition their reinsurance purchasing from being on an aggregate basis to being on an occurrence basis,” he said. “On the other hand, there’s really no suitable products available to cater to that. Our belief, and Ariel’s belief, is that the existing product suite and existing attempts at addressing the demand are not yet fit for purpose. We’ve wanted to address that for some time.”

Husbands highlighted how Hiscox and Ariel share a strong cyber pedigree, with the former having written non-proportional cyber products of all kinds for a decade now, as one of the first markets to launch its cyber product suite in 2014. In addition, he said, Hiscox developed the market’s first cyber ILW (Industry Loss Warranty) product and first parametric transaction.

Meanwhile, he said, from early conversations with Ariel, it became apparent that the business was already at a very advanced stage of developing the contract language at the heart of the CyberShock wording so the alignment of ambition between the firms was clear from the offset. Ariel had already started putting pen to paper in terms of developing the product and, like Hiscox, they proved willing to back the product with significant capacity.

“We think that’s going to be crucial in getting traction with clients,” he said. “Our combined capacity offering for this is $50 million per programme which, in the context of cyber insurance, is a really meaningful amount.”

The final piece of the puzzle for Husbands and his team was the calibre of the Ariel team – who bring an extensive background in cybersecurity and a strong grasp of the underlying risk of this peril.

Who does CyberShock target?

On the rollout of CyberShock, Husbands highlighted that it is designed for global writers of affirmative cyber. It offers up to five bespoke heads of coverage, though clients can tailor that to the needs of their portfolio, he said, and it’s designed to protect clients against a wide range of cyber-specific perils.

 “By designing it like that, we hope that we can absorb the main catastrophic risks, which could impact their portfolio,” he said. “So that includes software service or hardware supply chain disruption, malware propagation, the widespread exploitation of a zero-day vulnerability and cloud outages, among a number of other things. We’re really trying to identify the core cyber risks that clients face, and to provide a product which enables them to transfer them.”

For Hiscox and Ariel, the strongest selling point of the product – and a core reason behind its creation – is the certainty of coverage it can offer the market. For some time in the excess of loss cyber marketplace, Hiscox has seen a lot of attempts to shoehorn casualty style language into a cyber product, he said, which it feels introduces very significant ambiguities into the functioning of the product. That, in turn, risks leaving it quite open-ended as to which perils are and are not covered, and also how losses get aggregated into the treaty.

“It’s really important to us that clients, as well as reinsurers, aren’t faced with the threat of a costly dispute over coverage after a loss,” he said. “They have to know exactly when the protection we offer will respond or won’t respond. That’s what we’re trying to achieve with CyberShock. There’s a big difference in our minds between loose language and broad coverage. And we’re trying to avoid the former and provide the latter.”

While that certainty of coverage element is the main selling point of the product, not least because of the question it raises as to how some other occurrence products in the marketplace would respond to a major event, Husbands noted that there is a range of benefits from this consortium for multiple stakeholders.

For example, he said, the excess points the product is capable of supporting are much lower than in traditional aggregate products – which often see retentions significantly greater than 100% of gross income. By contrast, CyberShock ensures that clients could, in principle, recover from the product without being in a net loss-making position because the consortium is willing to entertain somewhat lower retentions – an important selling point for clients concerned about retentions.

The hope is that CyberShock will help grow the market, Husbands said, by attracting more buyers and enabling more clients to transfer some of the risks which could be borne by the reinsurance marketplace.