Beazley, a U.K. insurer and reinsurer, inked a private, $45 million cyber cat bond deal in early January 2023 which, for the first time, provided Wall Street investors with a transaction covering cyber risk that is tradeable in the Rule 144A market. It opened the door to more cyber cat bonds toward the end of 2023 and going ahead potentially much more cyber-insurance coverage for organizations at risk of cyberattacks.
Beazley pursued two more similar transactions in 2023 before completing in mid-December the $140 million PoleStar Re offering, a full-fledged Rule 144A transaction that can be traded among qualified institutional buyers (QIBs).
Beazley was originally seeking $75 million from PoleStar Re and increased the deal's size after finding strong investor demand, which toward year-end propelled three other cyber cat deals from different sponsors.
"With four cyber 144A deals coming to market in November and December, cyber ILS (insurance-linked securities) started off with a bang this year that far exceeded all expectations held by the market even six months earlier," said John Seo, co-founder and managing director of Fermat Capital Management (FCM), one of a handful of institutional investors in Beazley's initial January offering.
The secrets to success
Greater market acceptance of the sophisticated models that cat-bond investors use to gauge cyber risk accounted for the unexpected success of cyber cat bonds' debut, including $75 million, $150 million and $50 million deals, respectively, by Axis Capital, Chubb and Swiss Re, said Seo. That was just one reason, however. The reinsurance market, which insurers typically transfer risk to first before tapping the cat bond market, faced insufficient capital to take on more risk, while demand for cyber insurance remained strong.
Attractive pricing was another draw for investors. Chubb's East Lane Re VII offering, for example, priced for a spread of 9.25%, after being upsized from $100 million, according to the Artemis website, which tracks the ILS market.
From his perch at FCM, Seo oversees one of the largest asset-management funds dedicated to ILS—composed mostly of Rule 144A cat bonds—that provides pension funds and other institutional investors with exposure to catastrophe risk.
"Ostensibly, cyber cat pays like Florida hurricane [cat deals] but hits the portfolio like Australian earthquake, which is to say not much at all," he said, adding, "From a portfolio construction point of view, that's a compelling proposition."
The ILS market, whose volume mainly comprises Rule 144A cat bonds as well as some cat bond-like and private transactions, broke records in 2023. Yearly issuance reached $16.4 billion up from $10.4 billion in 2022, while outstanding volume jumped by 20%, to $42.9 billion, up from $35.5 billion.
Inflation resulting in higher property-replacement costs was the main driver of greater volume, according to Swiss Re, whose Swiss Re Cat Bond Performance Index recorded total returns for 2023 of 19.7%. Swiss Re's deal was the first cyber cat bond whose payout is triggered by industry loss, a more efficient way for reinsurers to structure transactions.
A new prospect
Catastrophe risk is viewed as uncorrelated with financial-market risk, but for all of cyber cat bonds' unexpected success in 2023, they make up just a sliver of the overall cat bond market.
Seo said another cyber cat offering could arrive early this year, but insurers and reinsurers must digest and assess how the market has developed thus far before the deal outlook becomes clearer.
Cyber cat bonds could significantly increase their share of the size of the overall cat bond market, because cyber risk—losses related to malware and other soft-ware driven attacks—is so prevalent and continues to grow. Companies of all sizes face risks of cyber attacks, yet the cyber insurance market remains relatively small and confined mostly to very large insured companies. To satisfy likely cyber-insurance demand from a broader array of companies, insurers will have to increase their capacity and the cat bond market presents a likely source of capital. That creates the potential for cyber to become a significant peril in the cat bond market, which today mostly covers hurricane risk and to a lesser extent earthquake, severe thunderstorms, inland flooding a variety of other risks.
Cyber cat bonds are structured to pay out only after a major cyber attack, when total losses exceed those covered by insurers and reinsurers. Fitch Ratings, however, issued a report January 25 explaining another potential risk. It said that a cyberattack affecting parties in structured finance transactions, whether a cat bond, collateralized loan obligation or other asset-backed security, could affect the bonds, even if the attack does not cause a default.
Servicers, for example, may be temporarily unable to identify collected payments that were part of the serviced portfolio before the attack and to service the underlying portfolio afterwards. An extended bond payment lapse could result in a ratings action, if not a default.
"Impaired servicing can ultimately affect the performance of SF transactions," Fitch says, adding that such factors "could be relevant to our assessment of structured finance transactions."
