The narrow case for cyber insurance backstops

Some potential disasters are so big that they could pose a profound economic threat. The terror attacks of 11 September 2001 caused an estimated economic loss of US$33-36 billion at the time. The 2011 Tohoku earthquake was responsible for US$210 billion. With such readily available reference points, it’s easy to imagine something so much worse. In fact, it’s to remedy failures of imagination that ‘insurance backstops’  exist. 

A backstop is a government programme designed to provide economic relief for loss events so extreme as to threaten the solvency or viability of the insurance system, either in a particular country or worldwide. The United Kingdom has Pool Re for terrorism risks, and the United States adopted the Terrorism Risk Insurance Act (TRIA) in 2002 to provide a remedy for extreme economic impact following a terror attack. Other mechanisms exist for flood, earthquake, and regional risks. 

The rise of cyber risk – particularly systemic cyber risk – has led governments to contemplate the need for cyber backstops. This follows the assumption that the potential economic consequences of cyber catastrophes could be unmanageable.  However, aggregate natural catastrophe economic losses from 1998-2023 are approximately 14 times greater than cyber catastrophe losses for the same period.

Why Rishi was right

Former UK prime minister Rishi Sunak ended consideration of a cyber backstop in March 2024. It’s a decision that makes sense. Cyber catastrophe economic losses have not been severe, and the US$324 billion impact from such events has been absorbed economically, even alongside much worse natural catastrophes. Further, the insurance industry has shown no signs of needing the depth of capital that a backstop is intended to provide. It handled with ease approximately US$1.5-2 billion in industry-wide insured losses from four recent cyber catastrophe events in 2023 and 2024. Busy natural catastrophe years like 2017, which saw US$144 billion in insured losses, reveal just how much capacity for loss the insurance industry has to offer. 

The limited case for backstops

A cyber backstop may not be an immediate economic security concern, but it does have a long-term role to play. Rather than provide direct support for economic losses from cyber catastrophes, a backstop could be used as a confidence-building measure for driving more capital into the cyber insurance market. In interviews conducted for my ongoing doctoral thesis with 34 cyber insurance and reinsurance industry professionals, the topic of government backstops arose only infrequently. 

However, three specific use cases for government backstops did arise: 

• the depth of risk-transfer capacity available in the market, 
• the psychological benefits of backstops, and 
• the use of backstops to attract more insurance and reinsurance industry capital for future market growth.

Some respondents worried that the insurance industry lacks the depth of capital necessary to handle the ‘big one’, even though the ‘big one’ has likely already happened and been absorbed. After all, the US$326 billion in cyber catastrophe losses sustained since 1998 have not had a meaningful impact on commerce or society.

For those entering the cyber insurance market with lingering fears about the future, the notion of a cyber backstop is comforting. One respondent, an insurance-linked securities (ILS) manager, added a layer of nuance, suggesting that such a backstop should only be for the most extreme events, explaining that the market needs to ‘come to a view of what’s right for the private market to take and what’s right for the states to assume,’ using cyber war as an example of the latter. 

More interesting than the business and market implications is the connection to a pressing psychological concern. Insurers and reinsurers may be more inclined to increase their commitments to the insurance sector if they know government capital is available to support them if the unimaginable happens. A cyber insurance executive in the United States explained that ‘a backstop would be helpful psychologically’ because insurers and reinsurers would ‘know that there is a safety net of sorts – that [a cataclysmic event] is not just a continuous and open-ended freefall.’ It’s not the safety net itself that matters here, according to the respondent. Rather, it’s  the idea of it. That psychological element can make insurers and other risk-bearers more comfortable with cyber risk. 

Perhaps the most unusual suggestion was that a cyber backstop could be used not as a security measure but as a way to stimulate the growth of the cyber insurance sector, relying on the psychological factor. One ILS manager suggested, ‘Ideally, government would be the “midwife” to the delivery of a larger market in the future.’ It’s something that state actors have done before, he continued, ‘Florida has done a very skilful job of that,’ with regard to its state-backed insurer, the Citizens Property Insurance Corporation. 

Such mechanisms, the respondent explained, can be used to increase or decrease the amount of capacity needed based on the amount of capacity in the insurance market already, along with the demand for insurance protection. As insurers get comfortable and run profitable cyber businesses, the backstop could shrink, and after a significant industry-wide insured loss, the support from a backstop could adjust. 

The future is flexible

Rather than set a threshold at which the cyber insurance government backstop would write checks to insurers, the better alternative would be to structure a programme that ‘flexes’ – to borrow a phrase from the respondent fond of midwifery – based on the size of the cyber insurance market itself. Today, customers in the United States pay US$8 billion in cyber insurance premium, taking a 60% share of the estimated US$13 billion worldwide market. After a truly large cyber catastrophe, insurers would likely reduce their participation in the cyber insurance market, constricting the market. If the market’s cyber revenue shrank to US$4 billion, hypothetically, insurers would need less support from a backstop.

Instead of setting an overarching loss threshold, it would make more sense for a cyber backstop to change the point at which it pays based on losses relative to market size – called the ‘loss ratio’. A backstop could begin to provide financial relief following a cyber catastrophe that reaches a 300% loss ratio – meaning a US$24 billion loss to the US insurance industry as a whole. If the insurance industry were to shrink after such an event, due to insurer fears about the risk, the threshold would shrink as well. So, if premium dropped to US$4 billion the following year, the backstop would engage at US$12 billion. As insurers became comfortable with cyber insurance again, they would start writing more business, generating more premium, and pushing the threshold higher.

The implementation of a government backstop to stave off societal financial ruin isn’t necessary. However, if done properly, a cyber backstop could assuage the fears of the cyber insurance industry, stimulate an increase in economic security through market activity, and provide a safety net to catch the unimaginable.