The Supply of Cyber Risk Insurance

Cyber risk economic losses are large and growing, yet the insurance market for cyber risk is tiny, amounting to 0.4% ($2.8 billion) of premiums in the US property casualty insurance market in 2020. In this paper, we analyze the constraints that the insurance industry faces in providing larger capacity. We argue that cyber risk is special in that it combines (i) heavy-tailedness, (ii) uncertain loss distribution, and (iii) asymmetric information in underwriting. The combination of factors (i)-(iii) creates a tension between a need to raise substantial amounts of capital to finance heavy-tailed and uncertain risks and an expensive compensation demanded by investors due to information frictions. To circumvent asymmetric information costs, insurers can use internal capital. Hence, suppliers of cyber insurance are large insurance groups with a deep internal capital market. However, their capacity is constrained by the group’s size. We document stylized facts about the US cyber risk insurance market. We then establish the causal inference that insurers primarily rely on the internal capital market to supply cyber risk insurance using an exogenous shock of the non-US affiliated reinsurance tax treatment in 2017. Finally, we test which of the three features (i)–(iii) of cyber risk contribute to the cost of external capital and confirm that all of them play a significant role.