Reinsurers are the primary absorbers of cyber accumulation risk, S&P Global Ratings said in a new report. Falling rates and rising exposures are pushing the cyber market towards a critical crossroad. S&P said reinsurers will determine the outcome.
S&P expects reinsurers to function as the backbone of the cyber risk transfer market as exposures grow in both scale and interconnectedness. Risk flows from policyholders to primary insurers and into the reinsurance market, where a large share of global cyber exposure ultimately clusters.
"Cyber reinsurers hold the keys to market discipline as they set underwriting standards, shape pricing, and promote consistent risk management across the cyber insurance market," S&P said. "For these reasons, reinsurers will ultimately play a central role in determining which of the two scenarios emerge."
S&P outlined two starkly different market scenarios. In the first, insurers implement controlled rate increases that keep combined ratios below 100% and preserve underwriting profitability. In the second, weak pricing discipline produces sustained underpricing and profitability declines materially over the next one to two years.
A disruptive second-scenario correction would resemble those seen in the cyber market in 2021 or the global P&C reinsurance market in 2023. S&P said it would force sharp premium increases, capacity reductions and much tighter underwriting standards.
Ample capacity remains available across both proportional and non-proportional cyber reinsurance structures, S&P noted. Moderately softer reinsurance terms and continued competition among capacity providers have followed as a result.
The cyber reinsurance market is maturing beyond traditional quota share arrangements. Reinsurers are increasingly deploying non-proportional structures, including aggregate excess-of-loss, stop-loss, catastrophe event, and occurrence-based protections, as demand shifts towards tail-risk and accumulation coverage.
Average quota share cession rates in cyber reinsurance have already fallen from 57% five years ago to 45% today, according to Howden Re research. The non-proportional market is projected to absorb 6.5% of ceded premium in a US$30 billion global market scenario, up from 4% currently.
"The decline in cyber insurance rates is beginning to slow, with early signs of improving pricing discipline that may help stabilise underwriting profitability and preserve the current reinsurance-led-market structure. However, adverse cyber loss trends and persistent competitive pressure could challenge pricing adequacy and increase the risk of market underpricing," S&P said.
Capital market activity in cyber insurance-linked securities remains subdued. Hannover Re's US$35 million Cumulus Re parametric cloud-outage cover is the only new cyber catastrophe bond in 2026. Cyber cat bonds represent just 0.19% of total cat bond issuance year-to-date.
Established sponsors, including Beazley, Chubb, and Hannover Re, renewed ILS structures in 2025 and 2026. However, AXIS Capital and Swiss Re did not renew their public structures, and no new cedents entered the market.
S&P attributed limited issuance to a lack of economic incentive rather than limited investor appetite. With ample traditional reinsurance capacity and broadly solid profitability, insurers and reinsurers have little reason to access capital markets through cyber cat bonds.
S&P said that if rising losses outpace primary pricing adjustments, cyber ILS structures could prove increasingly attractive as a supplemental source of scalable protection. A more challenging market environment could gradually increase the role of capital markets in financing cyber risk, the agency added.
