Considered one of the messages that Warren Buffett and Berkshire Hathaway’s top insurance executive, Ajit Jain, sent to investors through the company’s recent annual shareholder meeting in Omaha was that cyber insurance, while currently profitable, still has too many unknowns and risks for Berkshire, an enormous player within the insurance market, to be fully comfortable underwriting.
Cyber insurance has grow to be “a really fashionable product,” Jain said on the annual meeting. And it has been a money maker for insurers, a minimum of so far. He described current profitability as “fairly high” — a minimum of 20% of the full premium ending up within the pockets of insurers. But at Berkshire, the message being sent to agents is certainly one of caution. A primary reason is the issue in assessing how losses from a single occurrence don’t spiral into an aggregation of potential cyber losses. Jain gave the hypothetical example of when a serious cloud provider’s platform “involves a standstill.”
“That aggregation potential might be huge, and never with the ability to have a worst-case gap on it’s what scares us,” he said.
“There isn’t any place where that type of a dilemma enters into greater than cyber,” Buffett said. “It’s possible you’ll get an aggregation of risks that you just never dreamt of, and possibly worse than some earthquake happening someplace.”
Berkshire is within the cyber insurance business
Industry analysts generally say while a few of Berkshire’s caution is warranted, the final state of the cybersecurity insurance marketplace is stabilizing because it becomes profitable. And Gerald Glombicki, a senior director in Fitch Rating’s U.S. insurance group, points out that Berkshire Hathaway is issuing cybersecurity policies despite Buffett’s caution. Based on Fitch’s evaluation, Berkshire Hathaway is the sixth-largest issuer of such policies. Chubb, which Berkshire recently revealed a giant investment in, and AIG are the biggest.
“Immediately [cybersecurity insurance] remains to be a viable business model for a lot of insurers,” Glombicki said. It remains to be a tiny market, representing just one percent of all policies issued, in response to Glombicki. Since the cybersecurity business is so small, it gives insurance firms latitude to implement various policies to see what’s working, and what is not, and not using a tremendous amount of exposure.
Berkshire, in addition to Chubb and AIG, declined to comment.
“There’s a component of unpredictability that could be very unsettling, and I understand where [Buffett] is coming from, but I believe it is actually hard to avoid cyber risk entirely,” Glombicki said. He added though that there has still been no significant litigation that assigns culpability or tests the boundaries of the policies, and until the courts hear some culpability cases, some insurers may proceed more cautiously.
‘Could break the corporate’ Buffett says
The issue with writing many policies, even with a $1 million limit per policy, is that if a “single event” seems to affect 1,000 policies. “You’ve got written something that under no circumstances we’re getting the right price for, and will break the corporate,” Buffett said.
While some notable leaders, like former Homeland Security chief Michael Chertoff — who now runs a worldwide security risk management firm — have called for a government cybersecurity backstop of some sort, most experts do not believe that is required at once. Glombicki says that while the feds are taking a look at what role they’ll play, intervention likely won’t occur until an incident prompts it.
Any government involvement “will probably occur after a giant, expensive cyber-incident,” he said. “After September 11, the federal government put together a terrorist risk program. In cyber, we have now not yet seen an attack of that scale. We’re still within the stage of interested by possible approaches.”
Cyber insurance data shows growth and market confidence
While the variety of cybersecurity policies being written is small now, analysts don’t expect it to remain that way.
“Rates are declining, which shows stability available in the market,” said Mark Friedlander, a spokesman for the Insurance Information Institute. Based on its data, cyber premiums are estimated to double over the following decade. In 2022, premiums totaled $11.9 billion. By 2025, Friedlander says, they’re expected to double to $22.5 billion and increase to $33.3 billion by 2027.
“That is clearly certainly one of the fastest-growing segments of insurance. More firms are writing cybersecurity policies than ever before,” Friedlander said, attributing confidence amongst insurers to more sophisticated underwriting and stabilizing rates. He cited a 6% decline in cybersecurity insurance rates in the primary quarter of 2024, following a 3% decline in 2023, as a transparent signal that insurers feel more confident about jumping into the business.
“Most business insurance, like auto and property, have all been increasing, so the decline is critical. It is an indication of stability and a decline in claims severity,” Friedlander said.
And more insurers are entering the market because they’ve the tools and data to cost the danger. “For those who can do it at sound rates, you’ll write that coverage,” Friedlander said.
‘You are losing money’
Buffett and his top insurance lieutenant don’t agree. It is the insurance “loss cost” — what the fee of products sold could potentially be — that has Berkshire on the fence with an even bigger move into cyber insurance. Jain said losses have been “fairly well contained” so far — not exceeding 40 cents on the policy dollar over the past 4 to 5 years — but he added, “there’s not enough data to give you the option to hold your hat on and say what your true loss cost is.”
Jain said that generally agents at Berkshire are discouraged from writing cyber insurance, unless they need to put in writing it to satisfy specific client needs. And even in the event that they do, Jain leaves them with this message: “Irrespective of how much you charge, it is best to tell yourself that every time you write a cyber insurance policy, you are losing money. We will argue about how much money you are losing, however the mindset ought to be you are not creating wealth on it. … After which we should always go from there.”
Google Cloud says the risks are being overstated
There’s a perception that cyber risk is rapidly changing and, due to this fact, too unpredictable to underwrite in a scientific way, says Monica Shokrai, head of business risk and insurance at Google Cloud. But she added that the perception doesn’t match reality, and that the danger can largely be managed.
“We do not hold the identical view as Warren Buffet on the subject,” she said. In Google’s view, the vast majority of cyber losses might be prevented or mitigated through basic cyber hygiene. Â
“By understanding security, you possibly can get to a spot where your controls are in a a lot better place, where the danger is more manageable,” Shokrai said. Devastating attacks from nation-states, meanwhile, are in a separate category and have been rare. Insurers are already inoculating themselves from potential risk by making exclusions for certain catastrophic events. Many cybersecurity policies have coverage exemptions for nation-state attacks.
“What they try to do is remain resilient and solvent within the event of a widespread event; what they’ve done to administer that’s put in exclusions,” Shokrai said, and people include critical infrastructure, cyber war, and other widespread disruptive events.
Ambiguities and subjectivities remain. What if someone is the victim of a cyberattack from a foreign-based gang that may not officially tied to a nation-state but can have received some ancillary logistical support? Can an insurance company invoke a nation-state exclusion? Shokrai says categorizing methods to attribute an event is the subject of much debate between insurance firms. “That may be a big debate between insurance firms; it’s a very important distinction that needs clarity,” Shokrai said.
Some experts say it’s the anomaly surrounding the industry’s margins that has investors like Buffett and insurance players like Berkshire spooked. But up to now, the business has proven to be sound overall. “It remains to be a viable business model for a lot of insurers,” said Josephine Wolff, an associate professor of cybersecurity policy at The Fletcher School at Tufts University, who has been studying the evolving marketplace for the past several years. But she added that a belief that the business is viable doesn’t suggest things should not always changing, pointing to the recent ransomware surge over the past couple of years that saw large payouts by insurance firms — though notably still not enough to make the business unprofitable for many issuers.
Cyber insurance helps make the whole ecosystem safer, in response to Steve Griffin, co-founder of L3 Networks, a California-based managed services provider that makes a speciality of cybersecurity. Policies require firms to stick to certain cyber standards to achieve coverage, and the more businesses that enroll for coverage, the safer the whole system becomes. And if a business knows they’ll be denied a claim in the event that they haven’t got some basic cybersecurity safeguards in place, that acts as an incentive to place them in place.
Berkshire does consider the business will grow, it just is not sure at what cost. “My guess is sooner or later it’d grow to be an enormous business, but it surely is likely to be related to huge losses,” Jain said.
“I’ll let you know that the majority people need to be in anything that is fashionable after they write insurance. And cyber’s a simple issue,” Buffett said. “You’ll be able to write loads of it. The agents prefer it. They’re getting the commission on every policy they write. … I’d say that human nature is such that the majority insurance firms will get very excited and their agents will get very excited, and it is very fashionable and it’s type of interesting, and as Charlie [Munger] would say, it could be rat poison.”
While Griffin understands Buffett’s caution, he sees a generational divide over the danger outlook, and is optimistic in regards to the cybersecurity insurance sector.
“Probably Warren Buffet would have called cybersecurity insurance a chance when he was younger,” he said.
Correction: Cybersecurity insurance rates declined 6% in the primary quarter of 2024, following a 3% decline in 2023. An earlier version of this text misstated the 2023 decline.
