Cyber risks: insuring the intangible, from traditional insurance to capital markets

The insurance industry plays a decisive role in this regard. However, the inherent characteristics of cyber risk—high volatility, low predictability, and interdependencies—have proven to be a poor fit for traditional insurance coverage, whose capacity faces serious limitations when confronted with high-intensity loss events. How do we continue to offer protection when the potential magnitude of the risk exceeds the sector's own reserves?

The recent report by The Geneva Association, titled “Catalysing Cyber Risk Transfer to Capital Markets: Catastrophe Bonds and Beyond,” offers a clear answer: it is time for capital markets to play a role in the transfer of cyber risks. At the same time, companies like MAPFRE are already deploying specific strategies to face this challenge, combining technological partnerships and innovation in the field of reinsurance.

Cyberinsurance products have experienced significant growth in the last decade. According to data from The Geneva Association's report, global premium volume has increased significantly, especially in markets such as the United States and Western Europe. However, this quantitative growth does not guarantee a real capacity to respond to large-scale events.

The reason is simple: traditional risk underwriting, pricing, and accumulation models are designed for threats with relatively stable historical patterns, such as fires or theft. But cyber risks do not behave in a linear way. Their intangible nature, the lack of consolidated historical data, and the possibility that a single event could simultaneously affect thousands of companies across different countries make exposure difficult to define and quantify.

As stated in the report itself, “the capital of traditional insurance is limited and may not be sufficient to absorb future catastrophic cyber events.”

This detailed analysis proposes expanding the scope of protection by resorting to a route already explored in other areas of extreme risk: capital markets. Just as there are catastrophe bonds for hurricanes or earthquakes, it would be possible to develop specific financial instruments for cyber risks, such as so-called “cyber cat bonds.”

The idea of transferring part of cyber risk to institutional investors is not new, but it is still in an early stage. For The Geneva Association, this strategy would allow additional capital to be injected into the insurance sector and absorb events that are currently nearly insurable. However, substantial progress is required in the standardization of contracts, data transparency, and risk modeling.

The key to attracting investors is the creation of understandable and measurable products. If cyber risk cannot be translated into clear financial terms—such as predefined losses, parametric indices, or well-defined trigger events—it will be difficult for pension funds or institutional insurers to participate. At this point, collaboration between the insurance industry, the technology sector, and the financial world becomes an essential condition.

While capital markets are preparing to take on a more active role, some insurers are taking steps to adapt their business models to the new context. MAPFRE is developing a dual strategy: firstly, facilitating SMEs' access to cyberprotection solutions; secondly, strengthening their reinsurance capacity through advanced analysis tools.

In the Spanish sphere, MAPFRE has established a partnership with the insurtech Cyberwrite, which specializes in cyber risk assessment for small and medium-sized enterprises. With this project, the insurance company can offer its customers real-time risk reports, generated using artificial intelligence. These reports provide an accurate picture of each company's digital vulnerabilities, quantify risk exposure, and design policies adapted to each case.

This approach is especially useful for SMEs, who have traditionally been neglected in terms of cyberinsurance due to the complexity of products and technical ignorance. Now, a company can take out insurance adjusted to its digital risk profile without having to have its own cybersecurity department.

On an international scale, MAPFRE RE has also intensified its commitment to cyber risk analytics, signing a three-year agreement with CyberCube, one of the most advanced platforms in the sector. This tool makes it possible to model large-scale cyber loss scenarios, identify risk accumulations by sector or region, and improve strategic decision-making regarding reinsurance.

The advance of digitalization and the growing sophistication of cyberattacks are redefining the very concept of risk. What until recently was considered an IT problem has now become a major economic threat, capable of causing damage comparable to that of a natural disaster.

In this context, the insurance sector faces a crossroads: either it adapts to this new reality or it will be overwhelmed by the scale of the losses. The Geneva Association's report clearly sets out a promising path: complement the capacity of traditional insurance with the resources of capital markets. But while this infrastructure is consolidated, the actors of the present must act decisively.

MAPFRE is a good example of how to combine technological innovation, data intelligence, and strategic collaboration to anticipate tomorrow's challenges. With initiatives such as the partnership with Cyberwrite and the agreement with CyberCube, the insurance company not only reinforces its competitive position, but also contributes to building a more resilient ecosystem against digital risk. An ecosystem in which, increasingly, insuring the intangible will be the norm, not the exception.

RELATED ARTICLES: