Abstract
This article examines the determinants of cyber insurance participation, the amount of coverage offered and the performance of current cyber insurers. Our results support the competitive advantage hypothesis, but only partially support the business growth constraint hypothesis. We find that insurers offer cyber insurance to capitalise on their competitive advantage in understanding and pricing cyber risks. In particular, professional surplus insurers and insurers with surplus insurer affiliation demonstrate a competitive advantage in cyber insurance participation. We find limited evidence that insurers participate in cyber insurance to compensate for constraints on business growth. In addition, the type (standalone or packaged) and amount of coverage offered vary substantially across firm characteristics. Standalone coverage incurs higher loss ratios than packaged coverage, demonstrating its riskier nature. Changes in cyber insurance loss ratios are not driven by premium growth but by claim frequency and severity growth, emphasising the significance of cyber insurance policy design.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Notes
We use ‘cyber insurers’ to refer to those insurers that reported positive direct premiums written in cyber insurance.
According to NAIC’s definition, cybersecurity insurance applies to commercial insurance that is provided to businesses to help them manage cyber risks, and identity theft insurance applies to personal lines insurance that covers only identity theft and identity theft restoration.
In our data set, ‘cyber insurance’ represents an aggregation of cybersecurity and identity theft insurance. Cybersecurity insurance is sold to businesses to indemnify losses resulting from risks such as data breaches and business interruption. Identity theft insurance caters to individuals, indemnifying them for losses resulting from identity theft events such as theft of credit cards, social security numbers or bank account numbers. The market for identity theft coverage is only a small fraction of cyber insurance coverage, thus establishing cyber insurance as more a commercial line of insurance.
We also analyse the market concentration for different types of cyber coverage and observe that the cyber insurance market is becoming more competitive based on Herfindahl–Hirschman index value from 2015 to 2017. We also calculate the ratio of cyber insurance premiums to total premiums for individual cyber insurers and find that cyber insurance comprises a very small fraction of the overall business that a cyber insurer underwrites. The summary statistics are available from the authors upon request.
Ideally, it is more accurate to measure premium growth using total premiums net of cyber insurance premiums. Unfortunately, cyber insurance premium data is available only from 2015 to 2017, while the data we need to calculate d_dpw ranges from 2013 to 2016. We argue that because cyber insurance premium accounts for a very small fraction of total premiums of cyber insurers, its impact on the estimations is negligible.
Choi and Weiss (2005) consider market growth (premium growth at the state level). They argue that growth at the state level, if not ruined by new entrants, will lead to growth in individual firms without keen price competition, thus leading to increased profitability.
All independent variables take the year t − 1 value except for firm age (age), public trading status (list), organisational form (mutual) and group affiliation (unaffiliated) for which the year t value is used. The use of lag regressors helps reduce concerns about reverse causality, though reverse causation is not a major concern in our research design.
As a robustness check, we also include either the standard deviation of loss ratio or the standard deviation of combined ratio as a control variable to measure the overall underwriting risk of an insurer. Neither of the variables is significant and including them reduces our sample size significantly due to missing values, so we have dropped them from our regressions.
As a robustness check, instead of controlling Related_cyber, we use the percentage of direct premiums in personal lines of business as an explanatory variable and find that insurers with more personal lines of business are less likely to offer standalone cyber insurance, but more likely to offer packaged cyber insurance, especially packaged ID theft coverage. Our main conclusions on other variables remain unchanged. The results are available from the authors upon request.
As a robustness check, we also run regressions with unaffiliated reinsurance usage. The results of our key independent variables and other control variables are not affected by the change. Unaffiliated reinsurance usage is only positively significant at the 10% level for the Alone_ID regression with the all-insurer sample. It is also positively significant for the Alone_ID regression but negatively significant for the Packgd_CB regression when using the admitted insurers sample only. We also find that unaffiliated reinsurance usage has no significant impact on the cyber premium volume provided by cyber insurers.
We conduct a multicollinearity check by analysing variance inflation factors (VIFs). The VIF values of our variables fall well below the critical value of 10. The maximum VIF is 2.18.
To control for potential selection bias within our sample, we conduct a robustness analysis by employing a Heckman two-step estimation procedure. The first step implements a probit regression for Eq. (1) and an inverse Mills ratio is calculated from the first equation to be included in the second-stage regression as specified by Eq. (2). The results of the Heckman two-step regressions are materially the same as those of OLS regressions. As the Mills ratio is insignificant in five of the seven regressions, we choose to report OLS results. The Heckman two-step regression results are provided in Appendix 2.
To address the concern of whether the OLS model is valid for premium regression, we checked the distribution of the logarithm of cyber insurance premium. It is almost bell-shaped and we thus argue that the OLS model is reasonable in this case. We also look at the univariate distribution of cyber insurance premiums written, and find that only a small sample (80 insurer-years) has premium below USD 1,375, with most of them providing packaged cybersecurity and ID theft coverage. As a robustness check, we set these insurer-years to be non-cyber insurers and rerun our logistic regressions for cyber insurance participation, and our results (available from the authors upon request) stay materially the same. We thank one referee for bringing up these issues.
To address the concern of whether the OLS model is appropriate when many cyber insurers incur no losses, we run Tobit regression with the lower bound specified at 0. Our results (available upon request) stay the same.
Credit rating agencies view rapid growth in cyber insurance, and especially aggressive growth in standalone cyber coverage, as having a negative impact on an insurer’s credit rating (Fitch Ratings 2016).
All the ratio variables used in this study are winsorised at 2_pctl and 98_pctl to reduce the impact of outliers. We also conducted a robustness check by winsorising at 3_pctl and 97_pctl and obtained similar results.
The regressions show that professional surplus insurers are less likely to offer packaged ID theft coverage which is not surprising because ID theft coverage is typically offered as endorsements to homeowners and commercial multiple-peril insurance policies. Professional surplus insurers are not usually actively involved in such lines of business.
According to Friedman and Thomas (2017), larger organisations tend to seek standalone cyber coverage, while packaged cyber policies are generally written for smaller businesses. Aon (2017) also mentions that standalone cyber products were developed for firms with more sophisticated and more specific cyber risk exposures that are not adequately covered by endorsements or add-ons of traditional packaged policies. Therefore, perceivably, standalone cyber coverage handles more complicated cyber risks than does packaged cyber coverage. For example, as a leading provider of cyber insurance, AIG offers its clients either a standalone CyberEdge policy or a cyber insurance endorsement packaged with some traditional property and casualty policies. CyberEdge or CyberEdge Plus offer a broader scale of protection to policyholders than the packaged endorsement (see AIG 2020). The policyholder can also purchase a standalone excess-difference in conditions (CyberEdge PC) to fill gaps in coverage for cybersecurity risk.
Appendix 1 presents regression results for the admitted insurer sample (i.e. excluding professional surplus insurers). Similar results are observed for the independent variables previously discussed. The coefficients of Surplus_aff are significantly positive (in five of the seven regressions). This result suggests that insurers affiliated with professional surplus insurers are more likely to provide cyber insurance (both standalone and packaged coverage), confirming an information-sharing phenomenon and supporting the competitive advantage hypothesis (H2a).
We have omitted by-line size (LB_size) and by-line concentration (LB_conc) in the premium volume regressions by arguing that these two variables may affect a firm’s decision to expand into a new line, but should not impact how much premium an insurer can generate from the new line. They are also omitted out of identification concern when implementing the Heckman two-step procedure as a robustness check.
Appendix 3 presents regression results for the admitted insurer sample (excluding professional surplus insurers). Similar results are observed for all independent variables previously discussed. Insurers affiliated with surplus insurers write, on average, less coverage than other admitted insurers, especially standalone coverage. This result is counterintuitive to the competitive advantage hypothesis (H2a), as the benefits of information sharing should arguably enable insurers to better understand cyber risks and offer more coverage. One possible explanation is that these insurers may direct more sophisticated cyber risks from businesses, which require larger amounts of standalone coverage, to surplus insurers within the same group, keeping the more standard risks for themselves.
Small commercial insureds usually purchase cyber insurance with smaller limits, which are less costly to insure. Smaller companies, on the one hand, are less targeted on a per-company basis by cybercriminals than large companies. Therefore, Aon (2018) observed better loss ratios for small-medium enterprise-focused insurers than for the market overall. Large companies, on the other hand, tend to have greater risk and need higher policy limits; they tend to buy coverage from larger insurers (IRMI 2003). Customer preference in this sense may drive the finding that large cyber insurers tend to have a higher loss ratio than smaller cyber insurers.
Appendix 4 presents regression results for the admitted insurer sample. Similar results are observed for all independent variables previously discussed. Affiliation with surplus insurers does not have a significant impact on loss ratio, with the exception of packaged ID coverage.
Table 8 is based on growth in premiums, loss ratios and claim frequency and severity. This actually precludes new firms from the sample, as a firm must have data from two consecutive years to stay in the sample. Thus, the results presented in this session will not be significantly affected by new market participants. Our results (shown in Appendix 5, Tables 11–13) show that new participants have relatively high loss ratios but underwrite smaller premium volume than incumbents.
References
AM Best. 2017a. A.M. best special report: U.S. cyber insurance market topped $1 billion in 2016; more writers move to standalone policies. http://news.ambest.com/newscontent.aspx?refnum=200861&altsrc=140.
AM Best. 2017b. Surplus lines continue to overcome market pressures. Best’s Special Report Segment Review, September 1, 2017.
AIG. 2020. AIG cyber cover guide. https://www.aig.com/content/dam/aig/america-canada/us/documents/business/cyber/cyber-cover-guide.pdf.
AIR. 2017. Insuring cyber risk, AIR Issue Brief. http://www.air-worldwide.com/publications/white-papers/documents/insuring-cyber-risk.
AIR. 2018. AIR Develops Advanced Probabilistic Model for Global Cyber Risks. https://www.insurancejournal.com/news/national/2018/10/22/505209.htm.
Allianz. 2015. A guide to cyber risk: managing the impact of increasing interconnectivity. Allianz Global Corporate & Specialty https://www.agcs.allianz.com/assets/PDFs/risk%20bulletins/CyberRiskGuide.pdf.
Aon. 2017. Global cyber market overview: Uncovering the hidden opportunities. June 2017. https://www.aon.com/inpoint/library/white-papers/Cyber.jsp.
Aon. 2018. US cyber market update—2017 profits and performance. July 2018. https://www.insurancejournal.com/research/research/us-cyber-market-update-2017-profits-and-performance/.
Baer, W.S., and A. Parkinson. 2007. Cyberinsurance in IT security management. IEEE Security & Privacy, 5 (3).
Baggett, C.B., and C.R. Cole. 2018. The impact of regulation on surplus lines activity. Journal of Insurance Regulation 37 (5): 1–26.
Barth, M.M., and D.L. Eckles. 2009. An empirical investigation of the effect of growth on short-term changes in loss ratios. The Journal of Risk and Insurance 76 (4): 867–885.
Berry-Stölzle, T.R., A.P. Liebenberg, J.S. Ruhland, and D.W. Sommer. 2012. Determinants of corporate diversification: evidence from the property-liability insurance industry. The Journal of Risk and Insurance 79 (2): 381–413.
Biener, C., M. Eling, and J.H. Wirfs. 2015. Insurability of cyber risk: an empirical analysis. Geneva Papers on Risk and Insurance—Issues and Practice 40 (1): 131–158.
Böhme, R., and G. Schwartz. 2010. Modeling cyber-insurance: towards a unifying framework. ICSI and UC Berkeley Working Paper. http://www.icsi.berkeley.edu/pubs/networking/modelingcyber10.pdf.
Camillo, M. 2017. Cyber risk and the changing role of insurance. Journal of Cyber Policy 2 (1): 53–63.
Carson, J.M., and R.E. Hoyt. 1995. Life insurer financial distress: classification models and empirical evidence. The Journal of Risk and Insurance 62 (4): 764–775.
Che, X., and A.P. Liebenberg. 2017. Effects of business diversification on asset risk-taking: evidence from the U.S. property-liability insurance industry. Journal of Banking & Finance 77: 122–136.
Choi, B.P., and M.A. Weiss. 2005. An empirical investigation of market structure, efficiency, and performance in property-liability insurance. The Journal of Risk and Insurance 72 (4): 635–673.
Cummins, J.D., and D.W. Sommer. 1996. Capital and risk in property-liability insurance markets. Journal of Banking & Finance 20 (6): 1069–1092.
Dreyer, P., T. Jones, K. Klima, J. Oberholtzer, A. Strong, J.W. Welburn, and Z. Winkelman. 2018. Estimating the global cost of cyber risk. Rand corporation. www.rand.org/t/RR2299.
Eling, M., and R. Jia, and P. Schaper. 2020. Get the balance right: growth, profitability, and safety in the insurance industry. Available at SSRN: https://ssrn.com/abstract=3078470.
Eling, M., and W. Schnell. 2016. What do we know about cyber risk and cyber risk insurance? The Journal of Risk Finance 17 (5): 474–491.
Eling, M., and W. Schnell. 2019. Capital requirements for cyber risk and cyber risk insurance. North American Actuarial Journal. https://doi.org/10.1080/10920277.2019.1641416.
Eling, M., and J. Zhu. 2018. Which insurers write cyber insurance? Evidence from the U.S. property and casualty insurance industry. Journal of Insurance Issues 41 (1): 22–56.
Ernst & Young LLP. 2016. 2017 US property-casualty insurance outlook. http://www.ey.com/Publication/vwLUAssets/EY_-_2017_US_property-casualty_insurance_outlook/$FILE/EY-2017-US-property-casualty-insurance-outlook.pdf.
Fitch Ratings. 2016. Fitch: rapid growth in cyber insurance would be credit-negative. https://www.fitchratings.com/site/pressrelease?id=1001233, last accessed 2 June 2016.
Friedman, S., and A. Thomas. 2017. Demystifying cyber insurance coverage: clearing obstacles in a problematic but promising growth market. A report by the Deloitte Center for Financial Services. https://www2.deloitte.com/insights/us/en/industry/financial-services/demystifying-cybersecurity-insurance.html#endnote-sup-23.
Grant, R.M. 1991. The resource-based theory of competitive advantage: implications for strategy formulation. California Management Review 33 (3): 114–135.
Howard, L.S. 2016. Global, diversified multiline insurers best placed to withstand challenges: S&P. Extracted from https://www.insurancejournal.com/news/international/2016/05/13/408492.htm.
Insurance Journal. 2017. Auto Insurance Market To Shrink By 70% By 2050. Extracted from https://www.insurancejournal.com/news/national/2017/06/29/456094.htm.
Insurance Journal. 2018a. U.S. cyber market is $2 billion, growing fast, profitable: fitch. Extracted from https://www.insurancejournal.com/news/national/2018/05/10/488833.htm in October 2018.
Insurance Journal. 2018b. Burand’s state of the P/C insurance industry 2018: pricing cycle effects on agents. Extracted from https://www.insurancejournal.com/news/national/2018/05/29/490527.htm.
Insurance Journal. 2019. Cyber prices drop, while demand, supply, awareness continue to grow: marsh. Extracted from https://www.insurancejournal.com/magazines/mag-features/2019/05/20/526874.htm.
IRMI. 2003. Cyber-liability insurance issues for large companies. https://www.irmi.com/articles/expert-commentary/cyber-liability-insurance-market-update.
Kesan, J.P., R.P. Majuca, and W.J. Yurcik. 2005. Cyberinsurance as a market-based solution to the problem of cybersecurity—a case study. Workshop on the Economics of Information Security (WEIS) University of Illinois at Urbana-Champaign:http://infosecon.net/workshop/pdf/42.pdf.
King, AA., and C.L. Tucci. 2002. Incumbent entry into new market niches: the role of experience and managerial choice in the creation of dynamic capabilities. Management Science 48 (2): 171–186.
Klepper, S., and K.L. Simons. 2000. Dominance by birthright: entry of prior radio producers and competitive ramifications in the U.S. television receiver industry. Strategic Management Journal 21 (10–11): 997–1016.
Lelarge, M., and J. Bolot. 2009. Economic incentives to increase security in the internet: the case for insurance. IEEE INFOCOM 2009 proceedings https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=5062066.
Liebenberg, A.P., and D.W. Sommer. 2008. Effects of corporate diversification: evidence from the property-liability insurance industry. The Journal of Risk and Insurance 75 (4): 893–919.
Majuca, R.P., W. Yurcik, and J.P. Kesan. 2006. The evolution of cyberinsurance. University of Illinois at Urbana-Champaign.
Maksimovic, V., and G. Phillips. 2002. Do conglomerate firms allocate resources inefficiently across industries? Theory and evidence. The Journal of Finance 57 (2): 721–767.
Mayers, D., and C.W. Smith Jr. 1988. Ownership structure across lines of property-casualty insurance. Journal of Law and Economics 31: 351–378.
Marsh & McLennan Companies. 2017. MMC Cyber Handbook 2016. The Risk Management Society: 60.
McAfee. 2014. Net losses: estimating the global cost of cybercrime, June 2014. https://csis-prod.s3.amazonaws.com/s3fs-public/legacy_files/files/attachments/140609_rp_economic_impact_cybercrime_report.pdf, last accessed: October 18, 2018.
Montgomery, C.A. 1994. Corporate diversificaton. Journal of Economic Perspectives 8 (3): 163–178.
Montgomery, C.A., and S. Hariharan. 1991. Diversified expansion by large established firms. Journal of Economic Behavior & Organization 15 (1): 71–89.
Öğüt, H., N. Menon, and S. Raghunathan. 2005. Cyber insurance and IT security investment: impact of interdependence risk. WEIS http://dblp.uni-trier.de/db/conf/weis/weis2005.html#OgutMR05.
Ponemon Institute LLC. 2018. 2018 Cost of a data breach study: global overview. Benchmark research sponsored by IBM Security Independently conducted by Ponemon Institute LLC July 2018.
RMS. 2018. RMS releases industry’s first probabilistic cyber risk model. https://www.rms.com/newsroom/press-releases/press-detail/2018-03-07/rms-releases-industrys-first-probabilistic-cyber-risk-model.
Romanosky, S., L. Ablon, A. Kuehn, and T. Jones. 2019. Content analysis of cyber insurance policies: how do carriers write policies and price cyber risk? Journal of Cybersecurity 5 (1): 1–19.
Santos, T.C. 2017. Cyber insurance: considerations for business. The Risk Management Society: 2.
Shetty, N., G. Schwartz, M. Felegyhazi, and J. Walrand. 2010. Competitive Cyber-Insurance and Internet Security. In Economics of Information Security And Privacy, ed. T. Moore, D. Pym, and C. Ioannidis. Boston, MA: Springer.
Silverman, B.S. 1999. Technological resources and the direction of corporate diversification: toward an integration of the resource-based view and transaction cost economics. Management Science 45 (8): 1109–1124.
Swiss Re. 2017. Cyber: Getting To Grips With A Complex Risk. Sigma 1/2017.
Toregas, C., and N. Zahn. 2014. Insurance for cyber attacks: the issue of setting premiums in context. Cyber Security Policy and Research Insitute, the Goerge Washington University Report GW-CSPRI-2014-1.
Willis North America. 2013. Fortune 1000 cyber disclosure by financial institutions. Willis Special Report.
Wood, D.E. 2015. Are insurers underestimating the cyberthreat? Risk Management 62 (2): 30–34.
Acknowledgements
The authors would like to thank Ben Collier, J. David Cummins, Randy Dumm, Cameron Ellis, Martin Grace, Kwangmin Jung, Thorsten Moenig, Werner Schnell, Tim Shi, Krupa S. Viswanathan, Mary A. Weiss, Jackie Volkman Wise, seminar participants at Temple University and participants at the 2019 Western Risk and Insurance Association (WRIA) annual meeting and 2019 American Risk and Insurance Association (ARIA) annual meeting for comments and suggestions. Any errors are ours.
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Appendices
Appendix 1: Logistic regression: determinants of cyber insurance offering (excluding professional surplus insurers)
Cyber | Alone | Packgd | Alone_CB | Alone_ID | Packgd_CB | Packgd_ID | |
|---|---|---|---|---|---|---|---|
d_dpw | 0.007*** (0.002) | 0.009*** (0.003) | 0.005** (0.002) | 0.010*** (0.003) | − 0.021** (0.009) | 0.006** (0.002) | 0.005 (0.003) |
LB_size | − 4.166*** (1.249) | − 7.738*** (1.901) | − 3.392** (1.432) | − 8.921*** (2.219) | − 2.086 (2.077) | − 8.231*** (2.751) | 1.800 (1.387) |
LB_conc | − 4.311 (8.288) | − 26.359** (11.695) | − 0.477 (9.152) | − 24.457** (12.095) | − 24.350 (20.436) | − 26.767** (13.191) | 20.237 (12.671) |
Pwherf | 0.458** (0.210) | 0.599 (0.434) | 0.447* (0.250) | 0.446 (0.437) | 1.810* (1.079) | 0.417 (0.271) | 0.566* (0.296) |
Lbherf_dpw | 2.474*** (0.298) | 1.837*** (0.527) | 2.409*** (0.332) | 2.283*** (0.504) | − 0.474 (1.254) | 2.820*** (0.466) | 2.829*** (0.546) |
Surplus_aff | 0.877*** (0.275) | 1.439*** (0.402) | 0.741** (0.302) | 1.451*** (0.428) | 1.390 (0.948) | 0.193 (0.346) | 1.038*** (0.400) |
Size | 0.314*** (0.058) | 0.455*** (0.083) | 0.235*** (0.063) | 0.505*** (0.095) | 0.082 (0.161) | 0.273*** (0.075) | 0.248*** (0.083) |
Age | − 0.080 (0.114) | − 0.063 (0.168) | − 0.048 (0.142) | − 0.077 (0.173) | 0.247 (0.511) | − 0.141 (0.160) | − 0.020 (0.141) |
List | − 0.035 (0.284) | − 0.051 (0.364) | − 0.071 (0.314) | 0.021 (0.390) | − 0.425 (0.705) | 0.037 (0.367) | − 0.313 (0.419) |
Mutual | 0.654*** (0.167) | − 0.608 (0.438) | 0.757*** (0.194) | − 0.844** (0.405) | 0.188 (1.019) | 0.895*** (0.235) | 0.423* (0.245) |
Unaffiliated | − 0.407** (0.178) | − 0.105 (0.403) | − 0.527*** (0.189) | 0.063 (0.502) | − 1.150** (0.525) | − 0.507** (0.208) | − 0.363 (0.238) |
Asset_risk | − 0.022*** (0.005) | − 0.015*** (0.005) | − 0.022*** (0.006) | − 0.018*** (0.005) | 0.004 (0.022) | − 0.023*** (0.006) | − 0.019** (0.008) |
Liab_phs | − 0.022 (0.073) | − 0.346** (0.141) | − 0.001 (0.081) | − 0.346** (0.144) | − 0.280 (0.252) | 0.094 (0.098) | 0.057 (0.103) |
Npw_phs | − 0.004** (0.001) | − 0.004 (0.003) | − 0.002 (0.002) | − 0.005* (0.003) | 0.002 (0.006) | − 0.003 (0.002) | − 0.001 (0.002) |
Rating | 0.017 (0.100) | − 0.398*** (0.137) | 0.132 (0.096) | − 0.413*** (0.143) | − 0.277 (0.272) | 0.242** (0.113) | 0.161 (0.148) |
ROI | 0.113 (0.094) | − 0.130 (0.160) | 0.179* (0.094) | − 0.207 (0.178) | 0.660** (0.274) | 0.221** (0.105) | 0.119 (0.125) |
Related_cyber | 0.017*** (0.003) | − 0.012 (0.008) | 0.021*** (0.003) | − 0.021** (0.010) | 0.015 (0.012) | 0.009** (0.004) | 0.037*** (0.004) |
Rein_ceded | − 0.008 (0.011) | − 0.025** (0.011) | − 0.002 (0.009) | − 0.031** (0.014) | 0.012 (0.008) | − 0.001 (0.011) | 0.002 (0.006) |
RBC_ratio | 0.002 (0.001) | − 0.001 (0.004) | 0.003* (0.001) | 0.000 (0.004) | − 0.007 (0.005) | 0.002 (0.002) | 0.004** (0.002) |
Year = 2016 | 0.304*** (0.079) | 0.111 (0.104) | 0.299*** (0.088) | 0.166 (0.117) | − 0.065 (0.154) | 0.502*** (0.129) | 0.051 (0.058) |
Year = 2017 | 0.564*** (0.103) | 0.047 (0.196) | 0.623*** (0.108) | 0.147 (0.215) | − 0.372 (0.412) | 0.844*** (0.138) | 0.423*** (0.131) |
Constant | − 6.684*** (0.920) | − 6.435*** (0.887) | − 7.008*** (0.906) | − 6.962*** (1.080) | − 8.454*** (2.005) | − 7.300*** (0.848) | − 10.003*** (1.297) |
N | 6054 | 6054 | 6054 | 6054 | 6054 | 6054 | 6054 |
Pseudo R-sq | 0.289 | 0.265 | 0.280 | 0.293 | 0.204 | 0.305 | 0.280 |
Appendix 2: Heckman two-step regressions for cyber insurance premium volume
Panel A: For all insurers | |||||||
|---|---|---|---|---|---|---|---|
Cyber | Alone | Packgd | Alone_CB | Alone_ID | Packgd_CB | Packgd_ID | |
d_dpw | 0.007*** (0.002) | 0.005 (0.005) | 0.008*** (0.002) | 0.003 (0.006) | − 0.005 (0.040) | 0.002 (0.003) | − 0.004 (0.009) |
Pwherf | 0.658*** (0.217) | 1.483** (0.663) | 0.705*** (0.224) | 1.715*** (0.632) | 4.038 (5.267) | 0.001 (0.286) | − 1.640* (0.926) |
Lbherf_dpw | − 0.250 (0.500) | 2.454** (1.152) | − 0.557 (0.558) | 2.099 (1.382) | − 0.295 (1.650) | − 3.522*** (0.557) | − 7.258** (3.096) |
Surplus insurer | 0.164 (0.184) | 1.506** (0.590) | − 1.066*** (0.192) | 1.319** (0.636) | − 1.791 (1.345) | − 0.679*** (0.257) | 1.258 (1.541) |
Size | 0.788*** (0.062) | 0.685*** (0.214) | 0.741*** (0.059) | 0.569** (0.236) | 0.615 (0.490) | 0.369*** (0.070) | 0.004 (0.340) |
Age | 0.074 (0.085) | 0.361* (0.204) | − 0.018 (0.086) | 0.487** (0.210) | − 1.150* (0.656) | 0.302** (0.126) | − 0.180 (0.312) |
List | 0.152 (0.120) | 0.207 (0.277) | 0.091 (0.121) | 0.226 (0.297) | 2.333*** (0.894) | 0.052 (0.170) | 0.277 (0.450) |
Mutual | − 0.022 (0.186) | − 2.236*** (0.640) | 0.402** (0.205) | − 1.785** (0.805) | − 3.726*** (1.287) | − 0.136 (0.261) | − 0.413 (0.712) |
Unaffiliated | 0.642*** (0.245) | 0.946 (0.773) | 0.524** (0.258) | 0.654 (0.794) | 11.580* (6.719) | 0.919*** (0.338) | 1.880* (1.027) |
Asset_risk | − 0.010* (0.005) | − 0.029*** (0.011) | − 0.009* (0.005) | − 0.029** (0.012) | − 0.072** (0.034) | 0.007 (0.006) | 0.056** (0.027) |
Liab_phs | − 0.011 (0.054) | − 0.060 (0.185) | 0.055 (0.055) | 0.060 (0.192) | − 0.215 (0.850) | − 0.067 (0.077) | − 0.125 (0.191) |
Npw_phs | − 0.006*** (0.002) | − 0.012** (0.005) | − 0.005*** (0.002) | − 0.012** (0.006) | − 0.008 (0.015) | 0.001 (0.002) | 0.001 (0.005) |
Rating | − 0.161** (0.072) | − 0.531*** (0.174) | − 0.091 (0.082) | − 0.538*** (0.179) | 1.563 (1.792) | − 0.484*** (0.122) | − 0.575 (0.358) |
ROI | − 0.273*** (0.060) | − 0.444*** (0.127) | − 0.130* (0.068) | − 0.356** (0.139) | − 1.430 (1.203) | − 0.156* (0.090) | − 0.663** (0.261) |
Related_cyber | 0.005 (0.003) | − 0.020** (0.008) | 0.010** (0.004) | − 0.021* (0.011) | 0.034 (0.023) | − 0.013*** (0.003) | − 0.076* (0.042) |
Rein_ceded | 1.353*** (0.229) | 0.471 (0.571) | 1.473*** (0.234) | 0.323 (0.590) | 3.519 (2.352) | 1.317*** (0.290) | 1.613** (0.655) |
RBC_ratio | − 0.005*** (0.001) | − 0.009** (0.004) | − 0.004*** (0.001) | − 0.008** (0.004) | − 0.095*** (0.019) | − 0.004** (0.002) | − 0.017** (0.007) |
Year = 2016 | 0.227* (0.134) | 0.595** (0.278) | 0.206 (0.142) | 0.542* (0.292) | − 0.348 (0.503) | − 0.200 (0.204) | 0.017 (0.461) |
Year = 2017 | 0.322** (0.148) | 0.569** (0.281) | 0.363** (0.174) | 0.551* (0.297) | − 1.399* (0.758) | − 0.330 (0.220) | − 1.329** (0.662) |
Constant | − 4.100*** (1.471) | − 4.067 (4.259) | − 4.349** | − 2.771 (4.634) | − 5.056 (21.889) | 6.569*** (1.565) | 26.590** (13.407) |
Mills | − 0.064 (0.393) | 0.696 (1.043) | 0.000 (0.475) | 0.482 (1.107) | 0.610 (5.376) | − 2.398*** (0.349) | − 6.959** (2.862) |
N | 6458 | 6458 | 6458 | 6458 | 6458 | 6458 | 6458 |
Panel B: Excluding professional surplus insurers | |||||||
|---|---|---|---|---|---|---|---|
Cyber | Alone | Packgd | Alone_CB | Alone_ID | Packgd_CB | Packgd_ID | |
d_dpw | 0.006*** (0.002) | 0.002 (0.006) | 0.007*** (0.002) | 0.001 (0.007) | 0.162 (0.598) | 0.001 (0.004) | − 0.003 (0.006) |
Pwherf | 0.675*** (0.205) | 1.582** (0.750) | 0.704*** (0.214) | 1.968*** (0.725) | − 14.587 (61.453) | 0.000 (0.294) | − 0.473 (0.487) |
Lbherf_dpw | − 0.812 (0.535) | 3.003** (1.286) | − 0.987 (0.623) | 2.842* (1.625) | 10.674 (33.314) | − 4.151*** (0.593) | − 5.284*** (1.595) |
Surplus_aff | − 0.543** (0.215) | − 2.505** (1.026) | − 0.564*** (0.219) | − 2.713** (1.055) | − 16.246 (47.391) | − 0.756*** (0.221) | − 2.586*** (0.627) |
Size | 0.726*** (0.063) | 0.481* (0.247) | 0.708*** (0.062) | 0.511* (0.269) | − 0.726 (5.672) | 0.311*** (0.074) | 0.263 (0.180) |
Age | 0.042 (0.088) | 0.022 (0.268) | − 0.055 (0.089) | 0.034 (0.286) | − 2.084 (8.968) | 0.364*** (0.138) | − 0.175 (0.227) |
List | 0.224* (0.124) | 0.152 (0.324) | 0.216* (0.126) | 0.225 (0.338) | 5.739 (17.386) | 0.332* (0.191) | 0.888** (0.372) |
Mutual | − 0.239 (0.203) | − 2.496*** (0.654) | 0.187 (0.237) | − 2.850*** (0.888) | − 5.577 (14.343) | − 0.481* (0.284) | − 0.629 (0.531) |
Unaffiliated | 0.608** (0.236) | 1.021 (0.844) | 0.499** (0.253) | 0.757 (0.890) | 31.802 (85.140) | 0.802** (0.338) | 1.367** (0.660) |
Asset_risk | − 0.004 (0.005) | − 0.020 (0.013) | − 0.006 (0.006) | − 0.025* (0.014) | − 0.082 (0.374) | 0.015** (0.007) | 0.033** (0.015) |
Liab_phs | 0.028 (0.054) | 0.184 (0.256) | 0.064 (0.054) | 0.210 (0.269) | 3.079 (12.518) | − 0.059 (0.080) | − 0.031 (0.131) |
Npw_phs | − 0.006*** (0.002) | − 0.012* (0.006) | − 0.005*** (0.002) | − 0.012 (0.007) | 0.012 (0.176) | 0.001 (0.002) | − 0.003 (0.003) |
Rating | − 0.132* (0.071) | − 0.094 (0.274) | − 0.057 (0.079) | − 0.098 (0.285) | 7.421 (25.141) | − 0.450*** (0.124) | − 0.151 (0.196) |
ROI | − 0.286*** (0.063) | − 0.234 (0.170) | − 0.185** (0.073) | − 0.118 (0.190) | − 7.324 (19.837) | − 0.255*** (0.097) | − 0.571*** (0.173) |
Related_cyber | 0.004 (0.004) | − 0.011 (0.009) | 0.008 (0.005) | − 0.011 (0.012) | − 0.099 (0.427) | − 0.015*** (0.004) | − 0.047** (0.021) |
Rein_ceded | 1.295*** (0.237) | 0.632 (0.706) | 1.450*** (0.242) | 0.596 (0.742) | 7.276 (28.729) | 1.351*** (0.293) | 1.638*** (0.498) |
RBC_ratio | − 0.004*** (0.001) | − 0.006 (0.006) | − 0.003*** (0.001) | − 0.005 (0.006) | 0.003 (0.315) | − 0.003 (0.002) | − 0.010*** (0.004) |
Year = 2016 | 0.168 (0.138) | 0.602* (0.344) | 0.165 (0.145) | 0.552 (0.372) | 1.284 (7.647) | − 0.209 (0.215) | − 0.048 (0.336) |
Year = 2017 | 0.209 (0.153) | 0.413 (0.352) | 0.220 (0.176) | 0.442 (0.378) | 3.772 (16.751) | − 0.440* (0.229) | − 1.053*** (0.407) |
Constant | − 2.252 (1.563) | 0.363 (5.038) | − 2.741 (1.979) | − 0.866 (5.399) | 91.120 (326.187) | 8.358*** (1.599) | 16.833*** (6.517) |
Mills | − 0.512 (0.435) | − 0.442 (1.319) | − 0.399 (0.534) | − 0.031 (1.365) | − 28.099 (87.838) | − 2.802*** (0.364) | − 4.919*** (1.392) |
N | 6054 | 6054 | 6054 | 6054 | 6054 | 6054 | 6054 |
Appendix 3: OLS regressions for cyber insurance premium volume (excluding professional surplus insurers)
Cyber | Alone | Packgd | Alone_CB | Alone_ID | Packgd_CB | Packgd_ID | |
|---|---|---|---|---|---|---|---|
d_dpw | 0.011** (0.005) | 0.003 (0.009) | 0.011* (0.006) | − 0.000 (0.011) | − 0.020 (0.046) | 0.010 (0.007) | 0.010 (0.006) |
Pwherf | 0.783*** (0.245) | 1.720* (0.932) | 0.782*** (0.232) | 1.998** (0.889) | 3.896 (3.536) | 0.809** (0.321) | 0.258 (0.279) |
Lbherf_dpw | − 0.247 (0.451) | 3.340*** (1.066) | − 0.553 (0.487) | 2.879** (1.114) | 1.559 (3.392) | − 0.807* (0.483) | − 0.317 (0.846) |
Surplus_aff | − 0.342 (0.301) | − 2.232*** (0.662) | − 0.429 (0.301) | − 2.696*** (0.714) | − 1.638 (1.796) | − 0.111 (0.385) | − 0.738** (0.338) |
Size | 0.785*** (0.065) | 0.557*** (0.189) | 0.749*** (0.076) | 0.528*** (0.185) | 0.676* (0.321) | 0.508*** (0.104) | 0.790*** (0.112) |
Age | 0.020 (0.155) | 0.010 (0.338) | − 0.070 (0.163) | 0.015 (0.340) | − 0.890 (1.363) | 0.178 (0.159) | − 0.220 (0.235) |
List | 0.203 (0.237) | 0.149 (0.399) | 0.190 (0.252) | 0.230 (0.432) | 1.165 (2.609) | 0.291 (0.346) | 0.330 (0.277) |
Mutual | − 0.104 (0.223) | − 2.569*** (0.572) | 0.311 (0.203) | − 2.864*** (0.768) | − 3.951** (1.328) | 0.549** (0.245) | 0.320 (0.343) |
Unaffiliated | 0.535*** (0.195) | 1.038 (0.757) | 0.424** (0.179) | 0.766 (0.704) | 10.041 (5.968) | 0.485** (0.234) | 0.423* (0.231) |
Asset_risk | − 0.009 (0.006) | − 0.023 (0.017) | − 0.009 (0.006) | − 0.026 (0.018) | − 0.046 (0.042) | − 0.007 (0.010) | − 0.003 (0.009) |
Liab_phs | − 0.002 (0.095) | 0.118 (0.239) | 0.044 (0.103) | 0.192 (0.239) | − 0.337 (0.865) | − 0.011 (0.099) | 0.017 (0.159) |
Npw_phs | − 0.007*** (0.002) | − 0.012* (0.007) | − 0.005** (0.002) | − 0.011 (0.008) | − 0.003 (0.024) | − 0.002 (0.003) | − 0.004 (0.003) |
Rating | − 0.127 (0.116) | − 0.149 (0.218) | − 0.038 (0.119) | − 0.097 (0.218) | 0.953 (1.914) | − 0.161 (0.191) | 0.162 (0.147) |
ROI | − 0.277** (0.110) | − 0.287 (0.221) | − 0.163 (0.121) | − 0.155 (0.237) | − 1.127 (0.832) | − 0.012 (0.145) | − 0.376** (0.187) |
Related_cyber | 0.008* (0.005) | − 0.012 (0.016) | 0.011** (0.005) | − 0.011 (0.019) | 0.028 (0.019) | − 0.005 (0.006) | 0.023*** (0.006) |
Rein_ceded | 1.248*** (0.337) | 0.598 (0.778) | 1.412*** (0.358) | 0.589 (0.800) | 4.547 (2.688) | 1.024** (0.504) | 1.880*** (0.436) |
RBC_ratio | − 0.004** (0.002) | − 0.006 (0.008) | − 0.003* (0.002) | − 0.004 (0.008) | − 0.077 (0.043) | − 0.003 (0.003) | − 0.002 (0.002) |
Year = 2016 | 0.229** (0.113) | 0.602** (0.288) | 0.215* (0.123) | 0.541 (0.331) | − 0.117 (0.393) | 0.319* (0.176) | 0.031 (0.128) |
Year = 2017 | 0.309** (0.130) | 0.407 (0.339) | 0.311** (0.149) | 0.439 (0.375) | − 0.977 (0.927) | 0.427* (0.220) | − 0.201 (0.179) |
Constant | − 3.978*** (0.983) | − 1.214 (1.614) | − 4.197*** (1.013) | − 0.986 (1.466) | − 4.880 (9.458) | − 1.955* (1.069) | − 5.447*** (1.529) |
N | 1376 | 273 | 1225 | 244 | 37 | 830 | 716 |
Adj R-sq | 0.346 | 0.344 | 0.338 | 0.311 | 0.704 | 0.227 | 0.302 |
Appendix 4: OLS regressions for cyber insurance performance
Panel A. Pure loss ratio—excluding professional surplus insurers | |||||||
|---|---|---|---|---|---|---|---|
Cyber | Alone | Packgd | Alone_CB | Alone_ID | Packgd_CB | Packgd_ID | |
Size | 0.143*** (0.031) | 0.228*** (0.063) | 0.102*** (0.028) | 0.284*** (0.062) | 0.022 (0.121) | 0.155*** (0.036) | 0.025 (0.025) |
Age | − 0.081 (0.067) | − 0.253 (0.290) | − 0.104* (0.058) | − 0.236 (0.307) | − 0.158 (0.421) | − 0.014 (0.073) | − 0.081* (0.041) |
List | 0.068 (0.181) | − 0.173 (0.395) | 0.113 (0.155) | − 0.074 (0.404) | − 0.780 (1.596) | 0.051 (0.171) | 0.090 (0.087) |
Mutual | − 0.128 (0.109) | − 1.076*** (0.241) | 0.059 (0.103) | − 1.350*** (0.312) | − 1.302 (1.033) | − 0.153 (0.136) | 0.002 (0.058) |
Unaffiliated | 0.348*** (0.101) | 0.483 (0.461) | 0.212** (0.101) | − 0.000 (0.532) | 2.237 (1.679) | 0.242* (0.145) | 0.070* (0.041) |
Pwherf | 0.601*** (0.138) | 0.748 (0.451) | 0.533*** (0.135) | 0.734 (0.447) | 1.492 (1.619) | 0.386** (0.182) | 0.162 (0.099) |
Lbherf_dpw | − 1.058*** (0.330) | − 0.562 (0.911) | − 0.993*** (0.348) | − 1.324 (0.930) | 2.269 (1.669) | − 1.705*** (0.452) | − 0.277* (0.154) |
Surplus_aff | 0.217 (0.151) | 0.060 (0.451) | 0.084 (0.127) | − 0.397 (0.570) | 0.611 (0.817) | 0.221 (0.140) | − 0.104** (0.048) |
Year = 2016 | 0.135 (0.084) | 0.206 (0.181) | 0.165* (0.091) | 0.245 (0.192) | − 0.426 (0.330) | 0.286** (0.125) | − 0.111* (0.066) |
Year = 2017 | 0.102 (0.102) | 0.276 (0.237) | 0.177* (0.103) | 0.379 (0.258) | − 0.356 (0.513) | 0.361*** (0.124) | − 0.101 (0.084) |
Constant | − 0.631 (0.402) | − 0.803 (0.926) | − 0.198 (0.369) | − 0.746 (0.951) | − 0.930 (1.848) | − 0.622 (0.409) | 0.343 (0.282) |
N | 1362 | 268 | 1214 | 240 | 37 | 829 | 700 |
Adj R-sq | 0.109 | 0.075 | 0.084 | 0.098 | 0.118 | 0.133 | 0.039 |
Panel B. Loss ratio with defense and cost containment—excluding professional surplus insurers | |||||||
|---|---|---|---|---|---|---|---|
Cyber | Alone | Packgd | Alone_CB | Alone_ID | Packgd_CB | Packgd_ID | |
Size | 0.160*** (0.034) | 0.222*** (0.065) | 0.119*** (0.031) | 0.277*** (0.064) | 0.038 (0.119) | 0.175*** (0.042) | 0.026 (0.030) |
Age | − 0.109 (0.077) | − 0.269 (0.302) | − 0.138** (0.065) | − 0.251 (0.323) | − 0.183 (0.426) | − 0.051 (0.083) | − 0.088 (0.054) |
List | 0.078 (0.198) | − 0.160 (0.415) | 0.118 (0.165) | − 0.058 (0.429) | − 0.764 (1.633) | 0.071 (0.182) | 0.091 (0.109) |
Mutual | − 0.074 (0.130) | − 1.229*** (0.243) | 0.134 (0.127) | − 1.526*** (0.292) | − 1.335 (1.039) | − 0.069 (0.169) | − 0.020 (0.085) |
Unaffiliated | 0.255** (0.113) | 0.388 (0.444) | 0.115 (0.113) | − 0.144 (0.495) | 2.323 (1.679) | 0.081 (0.155) | 0.048 (0.060) |
Pwherf | 0.663*** | 0.701 | 0.596*** | 0.694 | 1.399 | 0.379* | 0.238 (0.156) |
(0.155) | (0.428) | (0.149) | (0.421) | (1.689) | (0.216) | ||
Lbherf_dpw | − 1.327*** (0.351) | − 0.472 (0.925) | − 1.261*** (0.370) | − 1.249 (0.940) | 2.273 (1.695) | − 2.070*** (0.476) | − 0.377 (0.248) |
Surplus_aff | 0.209 (0.172) | 0.119 (0.458) | 0.058 (0.144) | − 0.373 (0.561) | 0.701 (0.861) | 0.221 (0.156) | − 0.172** (0.079) |
Year = 2016 | 0.164* (0.087) | 0.244 (0.183) | 0.188** (0.091) | 0.282 (0.195) | − 0.413 (0.327) | 0.305** (0.125) | − 0.130* (0.076) |
Year = 2017 | 0.126 (0.103) | 0.458* (0.263) | 0.178* (0.105) | 0.566* (0.285) | − 0.335 (0.519) | 0.368*** (0.130) | − 0.128 (0.098) |
Constant | − 0.543 (0.413) | − 0.608 (0.931) | − 0.073 (0.390) | − 0.501 (0.975) | − 1.022 (1.884) | − 0.418 (0.444) | 0.476 (0.400) |
N | 1362 | 268 | 1214 | 240 | 37 | 829 | 700 |
Adj R-sq | 0.118 | 0.080 | 0.099 | 0.100 | 0.113 | 0.147 | 0.040 |
Appendix 5: Incumbent vs. new cyber insurers
Table 9 presents our analysis of the characteristics of new and incumbent cyber insurers. We find that the financial characteristics of new cyber insurers are, in general, very similar to those of the incumbents. Several differences are observed: new entrants tend to be smaller in size, possess higher asset risk and are less diversified across geographical areas than incumbents. New entrants are less likely to be affiliated with professional surplus insurers, supporting the notion that cyber insurance has expanded into the admitted insurer market even without affiliation with surplus carriers. Meanwhile, more private and mutual insurers are entering the cyber insurance market, which was heavily comprised of incumbent stock insurers. In addition, new entrants that offer standalone cyber coverage are more likely to be unaffiliated single insurers than the incumbent insurers, while new entrants that offer packaged cyber coverage are more likely to be professional surplus insurers than the incumbent insurers, suggesting that professional surplus insurers have observed the opportunity presented by the immense growth of the packaged cyber insurance market and thus have expanded into the market to compete with admitted insurers.
Table 10 presents regression results for the determinants of cyber insurance participation for the sample excluding incumbent insurers. Our results are similar to those of the all insurer sample (Table 4 of the paper), lending further support to our cyber insurance participation hypotheses. Table 11 presents regression results that compare the premium volumes offered by new and incumbent cyber insurers. We find that the control variables carry signs and significances that are consistent with our previous analysis for the all insurer sample (Table 5 of the paper). In addition, it is noteworthy that new entrants tend to write smaller amounts of premium in both standalone and packaged coverage. Table 12 presents an overview of the performance of new cyber insurers and incumbents at an aggregate level and Table 13 presents regression results on the performance of new cyber and incumbent insurers. We find that new cyber insurers, in general, tend to have higher loss ratios than incumbents, suggesting that new entrants may lack the underwriting experience of incumbents. However, further analysis in Table 13 reveals that only a subgroup of new insurers excluding professional surplus insurers show a weakly significant higher loss ratio and thus inferior performance.
Rights and permissions
About this article
Cite this article
Xie, X., Lee, C. & Eling, M. Cyber insurance offering and performance: an analysis of the U.S. cyber insurance market. Geneva Pap Risk Insur Issues Pract 45, 690–736 (2020). https://doi.org/10.1057/s41288-020-00176-5
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1057/s41288-020-00176-5