As cyberattacks on the public sector continue to rise, bond markets are devising innovative strategies to combat cyber risk.
The U.S. public sector witnessed a 50% surge in cyberattacks in recent months, as indicated by the Quarterly Global Threat Intelligence Report released by BlackBerry on Nov. 28. There was a 70% spike in unique malware from June to August of this year, with financial and healthcare organizations being prime targets.
Many organizations and municipalities are coping by purchasing cyber liability insurance, which offers coverage for things like data recovery and legal fees. Indeed, when local governments issue debt, ratings agencies are increasingly asking them about their cyber protections, the Wall Street Journal reports.
But sometimes the consequences of cyberattacks are "too big to insure," as Bloomberg noted recently—especially with ransomware groups now resorting to double extortion tactics on a regular basis. The latter means the hackers exfiltrate, i.e. copy or transfer, sensitive data in addition to encrypting it.
"The challenge is that insurance can only be part of the solution," wrote Doug Kreitzberg, founder and CEO of SeedPod, a Philadelphia-based cyber insurance company, on LinkedIn this week.
Enter cyber catastrophe bonds, a.k.a. cat bonds. Their purpose is to grease liquidity and insurance access. They work by letting capital market investors take on the thorniest risks; those investors then get higher returns.
Bloomberg put the total market for cat bonds, which also cover natural disaster risks, at around $40 billion. But according to Kreitzberg, total cybercrime costs have reached $1 trillion, which leaves a lot of risk uncovered.
"Cyber could be the fastest growing line of ILS [insurance-linked securities], in line with the growth rate of the underlying cyber insurance market, due to the relative lack of internal diversification within the peril," Joanna Syroka, director of new markets at Fermat Capital Management, told Bloomberg.
In fact, just last week, the very first cyber catastrophe bond moved into the public debt markets. Previously, this type of cat bond had been limited to private deals.
Issued by Long Walk Reinsurance, the $75 million cat bond covers cyber events across its main underwriting units, according to Bloomberg. The bond was sponsored by AXIS Capital Holdings.
In a press release, AXIS expressed confidence that this will be the first of many such deals.
"AXIS is proud that the ILS investor community has shown tremendous confidence in and acceptance of Long Walk, the first 144A cyber catastrophe bond," AXIS CFO Peter Vogt said. "We expect this transaction will serve as a template that the catastrophe bond market will use to support the availability of cyber insurance capacity in the years to come."
