Most captive insurance programs start narrow and expand as they mature. Newly formed Marsh-managed captives averaged one to two lines of coverage in 2025. Established single-parent programs averaged four, according to the firm’s Captive Solutions 2026 Benchmarking Report. Cyber and trade credit are where that expansion is heading now, and both lines carry specific challenges that commercial markets are not always equipped to handle.
Aileen Krehbiel (pictured), global engagement strategic client service leader of captive solutions at Marsh, explains what is pulling organizations toward captive structures for both lines, and what a viable program actually requires.
Fortune 500 companies increased captive premium volume by 9% in 2025, according to Marsh’s 2026 Benchmarking Report, with both cyber and trade credit recording notable premium growth among Marsh-managed captives that year. As programs mature, Krehbiel noted, organizations look to diversify beyond core lines.
“Once they view the captive as a mainstream risk financing tool, organizations often look to add new lines of coverage that include cyber, trade credit, and emerging risks,” Krehbiel said.
Global cyber insurance rates have also fallen for three consecutive years. Cyber rates declined 4% globally in Q2 2026, the 12th consecutive quarter of decreases, according to Marsh’s Global Insurance Market Index. Krehbiel said the value proposition for captive structures holds even as rates fall.
“For cyber, even in today’s softer market, captives can play a meaningful role especially through retention infill and providing access to the reinsurance market,” she said. “When companies cannot secure the coverage they need on acceptable terms, they may choose to retain a portion of the risk in the captive and use reinsurance for higher severity layers.”
Trade credit presents a different set of pressures. Krehbiel explained that a captive gives organizations direct control over program design and that reinsurers are more willing to extend capacity when the captive takes a meaningful share of the risk. Compared to a captive structure, the commercial market can carry more exclusions and fewer options to tailor coverage to a specific risk profile.
“Companies are pivoting to captives when the traditional credit market offers less capacity or certainty of coverage, especially in specific sectors and geographies,” Krehbiel said. For both lines, she added, the starting point is an honest assessment of what the organization can absorb and where external protection is needed.
“Captive owners should assess whether it’s appropriate to place a portion of cyber or credit risk in the captive by reviewing exposures, loss experience, and risk appetite, and then leveraging the reinsurance market to provide efficient protection for the higher-severity layers,” she said.
Neither cyber nor trade credit carries the years of loss data that underwriters typically rely on. Captive owners address this by using external benchmarking with a pure risk-transfer approach, Krehbiel explained. They do not rely solely on their own limited claims history.
Cyber pricing takes that shift furthest. “For cyber, pricing and program design are increasingly driven by an assessment of the insured’s control environment, which are key security measures underwriters expect to be in place before offering capacity or supporting a captive-backed structure,” Krehbiel said.
Trade credit, however, follows a different methodology. Krehbiel noted that industry segment and geographic exposure are the primary pricing inputs. Default risk varies materially by sector, buyer concentration, and region.
Reinsurance is what makes both lines viable inside a captive. More than one-third of Marsh-managed single-parent captives participated in reinsurance activity in 2025, per the 2026 Benchmarking Report. Marsh-managed captives ceded $11.5 billion to the reinsurance market that year.
“Reinsurance plays a vital role because both cyber and trade credit can be low-frequency, high-severity risks, and most captives are not positioned to hold the full risk on their balance sheets,” Krehbiel said. “As a result, captive owners commonly retain a defined working layer and then partner with a reinsurer or panel to provide capacity and add protection for volatility.”
A ransomware attack on a key supplier can stop payments before any claim is filed. The resulting default may fall between a cyber policy and a trade credit policy, qualifying under neither. Marsh’s 2026 Trade Credit Report surveyed 1,000 UK chief executives and finance directors. It found 99% cited cyber threats and digital fraud as growing credit risk concerns.
AI is accelerating the problem. The FBI’s 2025 Internet Crime Complaint Center annual report documented more than 22,000 complaints referencing AI, with adjusted losses exceeding US$893 million. It was the first time the bureau formally tracked AI-driven cybercrime.
“Cyber disruption is a growing concern, particularly as attackers leverage AI to increase the frequency and sophistication of events,” Krehbiel said. “When organizations place cyber and trade credit coverage in the commercial market, gaps can emerge where a loss falls between policy triggers, definitions, and exclusions.”
A captive offers a way to close that space. “A captive can be structured to bridge that gap by providing tailored protection for organization-specific exposures, especially where the commercial market is unwilling or unable to respond,” she said. “In practice, captives can participate within the cyber or trade credit retention layer, on a quota share basis, to cover policy exclusions, or fill gaps in policies.”
“Captive growth in cyber and trade credit is being sustained because captives create reliable capacity when commercial appetite shifts, address coverage gaps or restrictive wording, and provide greater program stability across market cycles,” Krehbiel said. For many organizations, she added, the captive also functions as a platform to access reinsurance and manage volatility in a disciplined way.
That case does not weaken as commercial rates fall. “Brokers should remind clients that a captive is a long-term risk-financing tool, not a short-term rate-arbitrage tool,” Krehbiel said.
The temptation when rates drop is to reduce the captive’s retention. Krehbiel argued against it.
“Instead of shrinking the captive simply because rates drop, captive owners should maintain a retention level that aligns with their strategy, governance, and risk tolerance,” she said.
In a softer market, she explained, the more productive conversation is about rebalancing. That means reviewing which layers sit in the captive versus the commercial market. It also means reassessing the reinsurance structure and using improved market terms to increase limits or enhance coverage without reducing the captive’s role.
“Viability depends on whether you’re adding this risk to an existing captive or forming a new captive,” Krehbiel said. “If an existing captive is already in place, adding a new line is as straightforward as a business plan update.”
Single-parent captives managed by Marsh averaged four lines of coverage and $9.1 million in gross written premium in 2025, per the 2026 Benchmarking Report. Newly formed captives averaged one to two lines. For programs already at scale, Krehbiel explained, the path to adding cyber or trade credit runs through documentation rather than structural change.
That documentation covers policy wording, program structure, exposure and loss history, and a pricing analysis. For cyber, she noted, incident logs, controls assessments, asset and vendor inventories, and scenario testing outputs are also useful. Trade credit calls for accounts receivable aging history, write-offs and recoveries, payment terms, and exposure breakdowns by sector and geography.
Building from scratch requires more foundational work. “If you’re establishing a captive, you’ll also need foundational items in place before the structure is viable: a defined operating model and governance framework, committed capital aligned to the volatility of the risk, selected service providers, and draft policy and reinsurance documentation,” Krehbiel said.
Domicile selection, she warned, is not a formality. “The selection of a domicile should align to the risk and operating model: the domicile’s ability to license the intended lines, regulatory expectations and responsiveness, permissible structures, ongoing compliance requirements, and the depth of local service-provider infrastructure,” Krehbiel said.
