MEMORANDUM
TO:

Property and Casualty Insurance (C) Committee

FROM: NAIC Staff
DATE:Oct. 20, 2021

RE:

Report on the Cybersecurity Insurance Market

The purpose of this report is to provide an understanding of the U.S. cybersecurity insurance market,
which encompasses insurers domiciled in the U.S., as well as alien surplus lines insurers that write
cybersecurity coverage.
Overview
Cybersecurity protection continues to be crucial to the effective and efficient operation of U.S.
businesses. Insurers face cybersecurity risks in their daily operations, as do all firms in the financialsector. The reasons the financial services sector is susceptible to cyberthreats are multifaceted.
Financial firms receive, maintain, and store substantial amounts of personally identifiable information(PII); however, insurers, in many cases, receive personal health information in addition to personal
financial information from both policyholders and claimants. In both cases, recent legislation ispotentially expanding the definition of PII, adding to the risk associated with a cybersecurity event.
Health care breaches continue to grow each year. 1 Health care breaches grew by approximately 55%
during 2020, 2 and the number of health care breaches continues to rise in 2021. 3 The increased valueof personal health information is due to health information containing more PII than financial records.
The NAIC collects data from insurers writing cybersecurity insurance each year through theProperty/Casualty Annual Statement Cybersecurity and Identity Theft Supplement (CyberSupplement). This report focuses on the cyber insurance market by presenting data found within theCyber Supplement, as well as alien surplus lines data collected through the NAIC’s International
Insurance Department. This year, 141 insurer groups submitted the data on the Cyber Supplement forthe 2020 calendar year.
The 2020 data show a cybersecurity insurance market, including both U.S. domiciled insurers and aliensurplus lines insurers writing business in the U.S., of roughly $4.1 billion in direct written premiums,
reflecting an increase of 29.1% from the prior year. 4 Insurers writing standalone cybersecurity
insurance products reported approximately $2.58 billion in direct written premiums, and those writing

https://www.securelink.com/blog/healthcare-data-new-prize-hackers/.
https://www.forbes.com/sites/davidbalaban/2021/05/30/attacks-on-healthcare-sector-are-on-the-rise/?sh=4658c7dc264c.
3 https://www.hipaajournal.com/july-2021-healthcare-data-breach-report/.
4 Based on this year’s restated alien surplus lines premium for 2019.
12

cybersecurity insurance as part of a package policy reported roughly $1.49 billion in direct written
premium. 5
Cybersecurity Insurance Coverage
The Cyber Supplement requires U.S. domiciled insurers to report the following information on
standalone cybersecurity insurance policies and coverage sold as part of a package policy:
•••
••
•

Number of claims reported (first-party and third-party).
Direct premiums written and earned.
Direct losses paid and incurred.
Adjusting and other expenses paid and incurred.
Defense and cost containment expenses paid and incurred.
Number of policies in force (claims made and occurrence).

Total Market – U.S. Domiciled Insurers
U.S. domiciled insurers writing cyber coverage reported $2.75 billion in direct written premium in 2020.
Direct earned premiums reported were $2.43 billion. Direct written premiums for the 2020 data year
increased by 21.7% from the 2019 data year.

Total Direct Wri�en Premium
Combined Standalone and Package(does not include Alien Surplus Lines Market)
2,753,782,002

2,262,014,339
2,028,911,563
1,890,683,601
1,674,826,575

2016

2017

2018

2019

2020

5 Alien surplus lines premium has been restated in this year’s report to $1.1 billion, which is a 23.3% increase from the numbers

reported in last year’s report.

To provide perspective, total U.S. domiciled insurers cyber direct written premiums of $2.75 billion
account for only 0.38% of $727 billion 6 property/casualty (P/C) direct written premium in the U.S.
During the 2020 calendar year, U.S. domiciled insurers reported a total of a little over four million
policies in force. Policies in force increased by 21.3% from 2019 to 2020, approximately the same
percentage increase insurers saw in premium growth. Average policy cost rose by 0.38%. Policy prices
have risen in 2021, and this will likely be reflected in the 2021 data to be reported next year.

Total Policies in Force by Year
Standalone and Package Policies Combined(does not incude Alien Surplus Lines Market)
4,019,428

3,314,347
2,996,820
2,603,970
2,110,571

2016

20172018

2019

2020

Loss Ratios
The top 20 groups in the cyber insurance market reported direct loss ratios in the range of 24.6% to114.1%. The figure below depicts the average loss ratios over the past four years. The loss ratio for2020 for the top 20 groups averaged 66.9%, up from 44.6% in 2019.
Exhibit 1 presents the loss ratios for these insurer groups. It is important to note that the cybersecurity
insurance market is still developing. Therefore, an element of catastrophe exposure continues to exist.
The cyber market continues to be a developing market; as a result, the wide range of loss ratios is notunanticipated.

6 https://content.naic.org/sites/default/files/inline-files/YE2019%20Industry%20Report.pdf.

The top 20 U.S. groups writing standalone and package cyber insurance combined are listed in thetable below.
2020
RANK
1234567891011121314151617181920

2019
RANK
1234567101181412139181519281725GROUP NAMECHUBB LTD GRP
AXA INS GRPAMERICAN INTRNL GRP
ST PAUL TRAVELERS GRP
BEAZLEY GRP
AXIS CAPITAL GRP
CNA INS GRP
FAIRFAX FINANCIAL
HARTFORD FIRE 7 CAS GRPBCS INS GRPTOKIO MARINE HOLDINGS INC
SOMPO GRP
ZURICH INS GRP
LIBERTY MUT GRPAPOLLO GLOBAL MGMT GRP
BERKSHIRE HATHAWAYMARKEL CORP GRP
EVEREST REIN HOL INCCINCINATTI FNCL GRP
SWISS RE GRP

DIRECT WRITTENPREMIUM$404,144,104
293,025,192
228,424,711
206,817,208
177,746,192
133,549,784
119,612,168
108,687,558
102,864,503
86,582,699
78,160,355
72,588,641
64,430,818
41,856,727
39,338,993
37,366,878
29,736,405
28,173,404
24,888,476
23,654,519

LOSS RATIO
W/DCC
61%
98.2%
100.6%
85.5%
47.9%
46.2%
105.7%
55.7%
25.4%
59.1%
51.1%
114.1%
40.4%
30%
29.6%
25.8%
38%
48%
24.6%
42.6%

MARKET
SHARE
14.7%
10.6%
8.3%
7.5%
6.5%
4.8%
4.3%
3.9%
3.7%
3.1%
2.8%
2.6%
2.3%
1.5%
1.4%
1.4%
1.1%
1%
0.9%
0.9%

During 2020, the top 10 U.S. groups wrote almost 68% of the cyber insurance market, with written
premiums totaling approximately $1.86 billion. This market share percentage varied little from 2019.
Standalone Policies Versus Package Policies – U.S. Domiciled Insurers
During 2020, insurers writing standalone cyber coverage reported $1.62 billion in direct written
premiums and $1.42 billion in direct earned premium. The standalone cybersecurity insurance direct
written premiums for 2020 increased by 28.1% from the prior year, and the total number of standalone
policies reported in 2020 increased by 22% from the number written in 2019.
The reported direct written premiums for cybersecurity package policies totaled $1.14 billion, which isan increase of 13.6% from the prior year. The NAIC did not estimate missing premium this year, as theinsurers not reporting direct written premium had very few claims and are not significant enough toinclude.
Alien Surplus Lines Insurers Writing Business in the U.S.
The NAIC receives cybersecurity data filed by alien surplus lines insurers via the NAIC’s International
Insurance Department. Alien insurers wrote $961.2 million in cybersecurity standalone package
policies in 2020, a 7.9% increase from the prior year. 7
Alien surplus lines insurers wrote $350.1 million in direct premiums for cybersecurity package policies,
a 71.4% increase from last year. The total written premium for both policy types was $1.3 billion,indicating a total premium increase of 19.8%.
Identity Theft Coverage – U.S. Domiciled Insurers Only
From a market perspective, the 2020 data continues to indicate that U.S. insurers’ most common
product related to cybersecurity is in the form of identity theft coverage. Insurers wrote approximately
20.3 million policies, both standalone and package policies, up roughly 4% from the prior year.
Currently, some homeowners policies include this coverage for no extra charge.
Standalone identity theft policies represented a little over $7 million in direct written premium, andthe number of policies decreased by 3.1% from the number of policies in force in the previous year.
Package policies represented $233.1 million in direct written premium, and the policies in force
increased by almost 4% from the prior year.
Ransomware
Ransomware poses a significant threat as it escalates in frequency and severity. Ransomware attacks
have grown by 62% since 2019. 8
Initially, ransomware merely encrypted files. The affected party would then need an encryption key tounencrypt the files. The victim of the attack pays a ransom to obtain the encryption key. The problem
is ransomware now also often involves extortion. Extortion comes into play when cybercriminals
threaten to release or sell sensitive data after collecting the ransomware payment. 97

Note: Alien surplus lines premium was restated for 2019.

8 https://www.blackfog.com/the-state-of-ransomware-in-2020/.

9 https://www.pbs.org/newshour/nation/why-ransomware-attacks-are-on-the-rise-and-what-can-be-done-to-stop-them.

Ransomware is likely one of the biggest reasons cyber insurance costs are on the rise. In 2020, there
was a 400% increase in ransomware incidents. Additionally, extortion demands climbed sharply. 10
Cyber Insurance Underwriting and Rating Changes
Currently, cyber insurers are seeing their expenditures, as a proportion of premiums paid, surpass 70%.
It should be no surprise that cyber insurance premiums are on the rise. 11 A recent survey of brokers
shows an increase of 10–30% in cyber insurance prices during the last quarter of 2020. Additionally,
the survey indicates the increased pricing trend continuing in the first quarter of 2021, as renewal
pricing on cyber insurance rose by an average of 18%. 12 Predictions indicate rates for cyber insurance
buyers to increase by 15–50% overall in 2021. 13 However, even as prices rise, demand has grown forcyber insurance in the second quarter of 2021. 14 These price increases are likely to be seen in the 2022
version of this report.
Insurers are adding exclusions to standard coverage lines to avoid duplication of cyber coverage.
Additionally, insurers are incorporating sub-limits. Elimination of overlapping coverage and sub-limits
will likely improve underwriting performance. 15
Additionally, cyber insurance limits have dropped from $10 million to $5 million for some industry
sectors. 16 At the same time limits are dropping, cyber underwriters are raising self-insured retention
levels. Excess markets are also charging almost as much as the primary insurer. 17
Changes regarding risk factors are occurring in the underwriting process. Underwriters are starting touse tools to evaluate prospective insureds’ computer networks to decide whether they will write thecyber business. 18
Data Table
The chart below depicts the information collected from all years of data collection.

10 https://www.insurancejournal.com/news/national/2021/07/07/621416.htm.
11Ibid.

12 https://www.gao.gov/assets/gao-21-477.pdf.
13 Gallagher Market Conditions 2021.

14 https://www.ciab.com/resources/q2-p-c-market-survey-2021/.

https://www.gao.gov/assets/gao-21-477.pdf
Ibid.
17 https://www.ciab.com/download/31507/.
18 Gallagher Market Conditions 2021.
1516

* Alien surplus lines data was not reported for the 2015 data year.
** As a result of further analysis, the data for the 2019 data year has been amended.

Marsh and McClennan indicated that the cyber insurance take-up rates for their clients in 2020 was47%, indicating a 5% increase from 2019 take-up rates. 19 While businesses are aware that cyber risk isa looming issue, it is not uncommon for policyholders to believe their current business insurance policy
cover a cyber loss. 20This report shows premiums grew substantially in 2020 as cyberthreats, particularly those having to dowith ransomware, continue to rise. As state insurance regulators monitor this evolving market they
may wish to consider whether any enhancements are needed to the Cyber Supplement to better
understand the market.

W:\National Meetings\2021\Fall\Cmte\C\Cyber_Supplement_2020_Report.docx

19 Cyber Insurance: Insurers and Policyholders Face Challenges in an Evolving Market, GAO, May 2021.
20 Riskandinsurance-digital.com/riskandinsurance/august_2021.