As the cyber insurance market has continued its rapid growth, its loss vulnerabilities have become increasingly clear.

A new report from Guy Carpenter and CyberCube Analytics has identified potential loss scenarios in the market as it currently stands that run in the billions of dollars. A long-lasting outage at a major cloud service provider could produce a $14.3 billion loss, for example, where a large-scale data loss could surpass $22 billion. Widespread data theft from one of the larger email service providers stands likely to generate a $19 billion loss, their report found.

Robert Bentley, CEO, Global Strategic Advisory at Guy Carpenter, said in prepared remarks that the finding points to a greater need for insurers and reinsurers to “develop a much more granular understanding of the potential impact of systemic events.”

Pascal Milliare, CyberCube’s CEO, offered a similar endorsement of using better data and enhanced analytics in order for carriers to adequately prepare for cyber insurance loss risks.

“Through improved data and enhanced analytics [insurers and reinsurers] can gain a much more granular understanding of these high-impact scenarios, enabling them to allocate capital appropriately and develop more nuanced underwriting strategies,” Milliare said in prepared remarks. “Only by adopting a robust, modeled, forward-looking view of cyber catastrophe risk can we ensure the ongoing development of a sustainable and profitable cyber insurance market.”

The study found the total annual cyber catastrophe insured loss figure for a 1-in-100-year return period was $14.6 billion, climbing to more than $16 billion for a 1-in-200-year event. It also determined that widespread data theft from a major email service provider was the most likely catastrophe loss scenario. The second most likely scenario: large-scale ransomware at a leading cloud service provider.

Other findings:

Business interruption costs factored heavily in the insured loss figures. Specifically, they made up 94.4 percent of the insured costs associated with a widespread data loss from a leading operating system. That number was 92 percent for a longer outage at a major cloud service provider.

Financial firms were most impacted during systemic cyber events, leading to 20 percent of the overall insured loss.

Researchers conducted their analysis based on a hypothetical $2.6 billion portfolio built using standard cyber insurance policy characteristics. CyberCube Analytics, using additional cybersecurity information and analytics, created a series of realistic catastrophe scenarios, applying frequencies and severities to build a probabilistic model. In total, the study analyzed 23 catastrophe loss scenarios.

Source: Guy Carpenter, CyberCube Analytics