Dive Brief:

• The cyber insurance market is expected to see strong growth over the next few years as malicious threat groups continue to target businesses with more sophisticated capabilities, according to a report released Thursday by Moody's Ratings. 
• Pricing has largely stabilized with moderate declines, and competition has increased thanks to the entrance of more insurance firms and investors into the market. Insurers are in a better position to manage losses, but loss ratios could increase if there is an uptick in ransomware and large losses, Moody's said.
• Aggregation risk remains a concern for the insurance industry, as revealed by the global Microsoft Windows outage linked to a faulty CrowdStrike software update. Single point of failure risk will likely lead to changes in policy language and other adjustments as concerns remain about supply chain attacks and businesses' reliance on connected technologies.

Dive Insight:

The cyber insurance industry is growing more sophisticated and taking on a larger role in how companies manage cyber risk, the Moody's report illustrates.

Insurers have helped their customers take proactive steps to better manage their cyber hygiene and incident response and governance.   They've also played a critical role in helping organizations manage the financial fallout of data breaches or malicious attacks. 

“In order to obtain coverage, cyber insurers now require policyholders to maintain minimum cybersecurity practices and controls, such as multifactor authentication for remote access and system backups,” Laline Carvalho-Neff, VP-senior analyst for Moody’s Ratings, said via email. 

“These practices improve an organization’s cyber hygiene, helping to reduce losses suffered by cyberattack victims,” Carvalho-Neff said. 

The Moody’s report comes amid a backdrop of rising policy concerns about the risk of business interruption and catastrophic events. The White House last week confirmed it is working on a policy to address long-term concerns about catastrophic cyber risk and the ability of the private sector to fully cover the gap.