As cyber insurance has grown over recent years, the reinsurance market is developing, with Howden Re predicting that between now and 2030, cyber reinsurance will grow from ~$5.5B to ~$9.5B.
This growth can be attributed to the significant advancement of modeling solutions, new products to transfer tail risk, and the increasing sophistication of reinsurance teams. For example, it is now much more common to see a cybersecurity specialist amongst underwriters and modelers.
Across the cyber reinsurance market, CyberCube has had the privilege of hearing from many reinsurers about their experiences. There’s a general consensus that while significant progress has been made, there are still areas where we can collectively improve to ensure cyber reinsurers are navigating risk with the clearest possible view, allowing them to grow into this prediction with confidence. The aim is always to achieve optimal profitability through a consistent, cross-functional understanding of their cyber portfolio.
In this blog, we'll explore some key challenges the cyber reinsurance market faces in sustaining this growth, based on our discussions and observations.
Unlike more mature lines, such as property catastrophe reinsurance, cyber hasn't fully converged on a standard schema or set of underlying information that is always shared as part of a submission. Not only is there not necessarily a standard, but the level of completeness can vary greatly. It’s common to hear that CyberCube’s carrier clients are upgrading their policy admin or underwriting system to better capture their cyber data.
While data quality and completeness did generally improve during the hard market, this progress has leveled off in the last year or so. This is compounded by the wide range of policy wordings and definitions that exist across the cyber (re)insurance market for different heads of cover or “events.”
This means reinsurers often find themselves piecing together fragmented information across various documents. Without cross-portfolio context or a consistent data framework, it's difficult to distinguish between cedants and to understand trends over time — potentially leading to mispriced or unidentified risk, which over time can affect margins.
This isn't a reflection on the quality of work, but rather a testament to the complexity of the data landscape in a rapidly evolving market.
There are several consequences for reinsurers here, including:
Reinsurance is about betting on the future while relying on the past. Underwriters analyze exposure data that’s often six months old, trend historical losses, on-level premiums, and then commit to covering risk for the year ahead. Due to factors like climate change, this balance has come under strain even in more traditional lines like property. With cyber, change occurs more rapidly across the threat landscape, pricing, underwriting standards, underlying exposure, and terms and conditions. This means that solely relying on backward-looking data presents a real problem for reinsurers.
This dynamic environment creates a visibility gap. Underwriters have expressed that they have limited ability to detect changes in portfolio exposure over time. This can leave them exposed to slow-moving shifts: loosening controls, drifting appetite, or declining portfolio hygiene that may not be revealed until the losses hit. Relying on static datasets and historical losses makes it difficult to manage risk proactively.
With limited data and a lack of market standardization, reinsurers have shared that they may miss out on hidden risk concentrations within cyber portfolios. Portfolios may appear diversified, but can conceal high-risk clusters, such as small and medium businesses (SMBs) operating in vulnerable sectors or with unpatched systems.
While a lot of the modelling analysis reinsurers complete is focused on market driving catastrophe losses that potentially trigger XoL (Excess of Loss) or ASL (Aggregate Stop Loss), or exhaust Quota Shares, there are tens of thousands of software vendors and even more vulnerabilities which still represent a significant risk. We saw this type of aggregation with the CDK Global event last year.
This means that systemic vulnerabilities aren't just theoretical — they can be present across multiple cedants within specific geographies, industry verticals, or critical technology dependencies (e.g. a shared cloud provider or widely used software). This represents an outsized risk that is currently difficult to identify and then manage against.
While many reinsurers CyberCube works with can effectively aggregate losses across their portfolios, it’s much harder to do the same for exposures tied to shared vulnerabilities.. Diving deeper into cedant portfolio security posture can give reinsurers more confidence in their underwriting and portfolio management decisions.
Understanding these nuances and their potential for widespread impact is a shared goal for the market to ensure more robust risk management.
Among CyberCube’s clients, cyber reinsurance is often folded into specialty or casualty treaty underwriting teams. As a result, during renewal season, underwriters and actuaries are pulled in multiple directions — juggling D&O, Marine, Terror, and other lines.
This structure makes sense for clients that haven’t yet reached the scale to justify dedicated cyber resources. But it also limits their ability to go deep: reinsurers are expected to make long-term commitments with limited time to thoroughly assess cedant portfolios.
From a modeling perspective, a majority of CyberCube reinsurers are using or actively considering APIs to integrate CyberCube’s models into reinsurance structuring and pricing platforms. This shows the ambition of the market to streamline operations and prepare for scale. Once these workflows are in place, reinsurers can consider how else they can enhance their analysis to further differentiate risk.
Compounding this challenge is the lack of specialized tooling in the market. This is likely driven by the market's relative size; it has only recently reached a point where commercial software makes sense to develop for specific cyber reinsurance needs. Without robust, data-backed insights and dedicated platforms, it can become more difficult for reinsurers to challenge assumptions or negotiate effectively. Mid-year audits, for example, often focus on high-level observations and qualitative information, making it difficult to uncover meaningful changes in exposure or risk. The challenge isn't a lack of conviction, but rather a lack of efficient means to develop insight.
Reinsurance has been a critical tool to enable cyber insurers to continue to grow, managing volatility and providing capacity to allow expansion. The challenges described are becoming more significant as the market scales.
At CyberCube, we speak to reinsurers every day who consistently share these concerns. They are actively seeking better portfolio visibility, more standardized data, and the right tools to illuminate where the risks truly lie.
In part two of this blog series, we'll detail practical solutions to these challenges, such as validating qualitative data with benchmarking, identifying risk patterns that can help inform strategic decisions, and looking at how specialized tooling can bridge the current gaps. CyberCube believes that by working together and leveraging advanced solutions, we can collectively enhance the stability and profitability of the cyber reinsurance market.