The once-meteoric rise of the cyber insurance market in Germany is experiencing a significant deceleration, according to a recent report from the Federal Financial Supervisory Authority (BaFin). While the sector showed robust growth in its early years, a confluence of factors, including market saturation and falling prices, is now tempering its expansion. This shift has prompted insurers to adopt a more cautious approach, particularly as the industry grapples with the inherent risks of this still-nascent field.

Slowing Growth Trajectory in Cyber Insurance

In 2024, the direct business of cyber insurance among German providers saw a growth rate of 13 percent, a notable decrease from the 66 percent and 56 percent recorded in 2021 and 2022, respectively. This data, released by BaFin on Wednesday, indicates a tangible cooling of the market. Gross premiums for direct cyber insurance reached €807 million in 2024. When including cyber-related riders and add-ons within other insurance policies, the total figure rises to €932 million. This represents a considerable slowdown from the double-digit growth experienced in preceding years, signaling a maturation of the market.

The reinsurance segment, which plays a crucial role in spreading risk across the insurance industry, has seen an even more dramatic shift. Gross premiums in this segment actually declined by 26 percent, falling to €1.64 billion. This contraction is attributed by BaFin to two primary drivers: market saturation, where the supply of cyber insurance capacity now meets or exceeds demand, and a decrease in prices. Reinsurers, in an effort to secure business in a more competitive landscape, have become more willing to underwrite a larger volume of cyber risks, thereby driving down premiums.

BaFin’s analysis is based on a comprehensive survey of 179 primary insurers and 28 reinsurers, along with 15 branches of foreign insurers operating in Germany. Of these entities, 66 primary insurers and 25 reinsurers offer cyber insurance policies. While these products were once hailed as a significant innovation with immense potential to address the growing threat of cybercrime, the initial euphoria has indeed begun to recede.

Underlying Causes of the Market Cool-Down

The slowdown in cyber insurance growth can be dissected into several key components. The most prominent factor cited by BaFin is market saturation. As more insurers entered the cyber insurance arena, the competition intensified. This increased supply of coverage, coupled with a potentially more stable threat landscape (or at least a more predictable one in terms of frequency and severity of claims compared to initial projections), has led to a situation where insurers are competing fiercely for a finite pool of customers.

Secondly, price competition has become a defining characteristic of the current market. In an effort to gain market share or maintain existing business, insurers have been compelled to lower their premiums. This is particularly evident in the reinsurance market, where reinsurers are more aggressively pricing their capacity. The willingness of reinsurers to underwrite more business at lower rates directly influences the pricing of primary insurance policies.

Furthermore, the inherent complexities and evolving nature of cyber risks contribute to a cautious approach from insurers. The cyber insurance sector is still relatively young, meaning that the long-term actuarial data required for precise risk assessment and pricing is less established than in traditional insurance lines. This lack of historical data, combined with the rapidly changing threat landscape – characterized by increasingly sophisticated attacks and novel vulnerabilities – makes it challenging for insurers to accurately predict and price potential losses.

The BaFin’s Vigilance: Monitoring Systemic Risk

BaFin’s heightened focus on cyber insurance is driven by a concern for systemic risk. Large-scale cyberattacks or widespread internet outages can trigger "accumulation losses," where a single event or a series of interconnected events could overwhelm the capacity of individual insurers. This potential for catastrophic losses, particularly for large corporations, necessitates close monitoring by the regulatory authority.

The authority’s survey, by capturing data from a broad spectrum of market participants, provides valuable insights into the health and direction of the cyber insurance market. The findings highlight that while the overall growth rate has moderated, the distribution of risk is also undergoing a subtle but significant shift.

Shifting Client Base: SMEs Gain Prominence

A notable trend emerging from BaFin’s data is the increasing proportion of cyber insurance coverage being purchased by small and medium-sized enterprises (SMEs). In 2024, SMEs accounted for 25 percent of gross premiums in the cyber insurance market, a significant jump from just 15 percent four years prior. Conversely, the share of premiums from large industrial companies has decreased, falling from 85 percent to 75 percent.

This shift indicates that while large corporations, which historically represented the bulk of the market due to their higher potential for significant losses, are either securing coverage elsewhere, self-insuring more effectively, or finding current cyber insurance offerings insufficient or too costly for their complex risk profiles. SMEs, on the other hand, appear to be increasingly recognizing their vulnerability to cyber threats and actively seeking protection. This trend is reported to be even more pronounced in the German market.

The increasing adoption by SMEs can be attributed to several factors. Firstly, there is a growing awareness among smaller businesses about the prevalence and impact of cyberattacks, from ransomware to data breaches. Secondly, the rising sophistication of cyber threats means that even smaller entities are no longer immune. Finally, a greater availability of tailored cyber insurance products designed for the specific needs and budgets of SMEs might be contributing to this trend.

Challenges in Insuring Large Corporations

The reluctance of many insurers to underwrite the full spectrum of risks for large corporations stems from the immense potential for financial damage. A single cyber incident affecting a global enterprise can have far-reaching consequences, not only for the company itself but also for its supply chain and its customers. The interconnectedness of modern business operations means that a breach in one part of a large organization can cascade into widespread disruption and significant financial losses, potentially running into billions of euros.

This risk profile makes underwriting such policies a complex undertaking. Insurers must meticulously assess the security infrastructure, risk management protocols, and incident response capabilities of large clients. The potential for a single event to trigger massive payouts means that insurers often opt to share these risks through syndication, where multiple insurers collectively underwrite a policy, or to limit their exposure through strict policy terms and conditions.

A Maturing Market Amidst Evolving Threats

The current slowdown in cyber insurance growth is not necessarily a sign of decline but rather a natural progression in the lifecycle of a developing market. As the industry matures, insurers are gaining a more nuanced understanding of cyber risks, and the market is adjusting to a more sustainable growth trajectory.

The increasing focus on SMEs is a positive development, as it broadens the base of insured entities and helps to protect a wider segment of the economy from the devastating impact of cyberattacks. However, the challenges associated with accurately pricing and managing the risks of large-scale cyber events remain a significant concern for the industry and regulators alike.

The future of cyber insurance will likely involve a continued evolution of products, pricing strategies, and risk management approaches. Insurers will need to invest in advanced analytics and threat intelligence to stay ahead of the curve, while regulators will continue to play a vital role in ensuring the stability and solvency of the market. The BaFin’s ongoing surveillance of this critical sector underscores its importance in safeguarding the German economy against the ever-present and evolving threat of cybercrime. As the digital landscape continues to transform, the resilience and adaptability of the cyber insurance market will be paramount. The current moderation in growth may well be a necessary recalibration, paving the way for a more robust and sustainable future for cyber risk management.