At the annual shareholder meeting in Omaha last month, Warren Buffett and Berkshire Hathaway’s top insurance executive, Ajit Jain, conveyed concerns to investors about cyber insurance. Although currently lucrative, Berkshire is cautious about underwriting cyber insurance, given the uncertainties and risks associated with it.

Jain noted that the profitability of cyber insurance is considerable, with insurers pocketing at least 20% of the total premium. However, Berkshire remains wary due to challenges in evaluating potential cyber losses stemming from a single incident cascading into broader cyber risks. Jain highlighted the potential massive aggregation of risks, especially in scenarios like a major cloud provider’s platform failure.

Buffett emphasized the unique complexity of cyber risk, pointing out the unpredictability and possibility of unforeseen risk aggregations surpassing conventional disasters like earthquakes.

Berkshire’s involvement in cyber insurance

Despite Buffett’s reservations, industry analysts suggest that the cybersecurity insurance market is gradually stabilizing and proving profitable. Fitch Ratings’ analysis indicates that Berkshire Hathaway is among the top issuers of cybersecurity policies, ranking sixth in the market. Notably, Chubb and AIG hold the largest market shares.

Fitch’s Gerald Glombicki acknowledges Berkshire’s cautious stance but notes that the cybersecurity insurance landscape is evolving positively. He mentions that the cybersecurity insurance sector is still developing, representing a mere 1% of all policies issued. This relative smallness allows insurers to experiment with various policies to gauge effectiveness without excessive exposure.

Both Berkshire and Chubb declined to provide comments on the matter.

“While there is indeed unpredictability, evoking caution, completely avoiding cyber risk is challenging,” Glombicki remarked. He emphasized the absence of significant litigation defining policy culpability, indicating that insurers might proceed cautiously until such legal precedents emerge.

‘Risk of Company Breakage,’ cautions Buffett

Buffett highlighted a critical concern regarding writing numerous cyber insurance policies, notably if a single event impacts a significant number of policies. He warned about the risk of underestimating proper pricing, cautioning that such miscalculations could potentially cripple companies.

While some industry figures, like former Homeland Security chief Michael Chertoff, advocate for a government-backed cybersecurity support system, most experts believe such intervention is premature. Glombicki suggested that governmental involvement is more likely after a large cyber incident triggers it, drawing parallels to the post-9/11 establishment of a terrorism risk program.

Glombicki anticipates that government action would occur following a substantial cyber event, akin to the response post-9/11. He highlighted the ongoing contemplation of potential approaches until a defining incident necessitates official action.

Growth and Confidence in Cyber Insurance Segment

While the cybersecurity insurance sector currently represents a small fraction, industry analysts forecast significant growth in the coming years. Mark Friedlander, from the Insurance Information Institute, noted that cyber premiums are projected to double over the next decade. In 2022, premiums totaled $11.9 billion, estimated to reach $22.5 billion by 2025 and further rise to $33.3 billion by 2027.

“The stability in market rates indicates a positive trend,” Friedlander remarked. He attributed insurers’ growing confidence to enhanced underwriting practices and rate stabilization. Notably, cybersecurity insurance rates saw a 6% decline in the first quarter of 2024, following a 3% decrease in 2024, indicative of increasing insurer confidence in the sector.

“Amidst rising insurance rates across other sectors, the declining trend in cybersecurity insurance rates is noteworthy, signaling market stability and reduced claim severity,” Friedlander emphasized.

More players are entering the cyber insurance market, leveraging data and tools to assess risks effectively. Friedlander emphasized that insurers are willing to underwrite coverage with sound pricing strategies, aligning with increasingly sophisticated underwriting practices.

‘Unprofitable Stance,’ Buffett acknowledges

Buffett and Berkshire’s cautious approach stem from uncertainties in estimating insurance loss costs accurately for cyber risks. While losses have been contained thus far, Jain expressed the inadequacy of available data to determine the true loss costs effectively.

Berkshire discourages agents from writing cyber insurance policies unless essential for specific client needs, emphasizing a mindset of viewing each policy as a financial loss. Jain underlines the financial risk of underestimating loss costs and advises agents to approach cyber insurance with caution.

Google Cloud’s Perspective on Risk Assessment

Monica Shokrai, from Google Cloud’s business risk and insurance division, challenged the perception of cyber risks being excessively unpredictable. She suggested that effective risk management strategies could significantly mitigate cyber threats.

Shokrai disagreed with Buffett’s views on cyber risk, arguing that most cyber losses are preventable through basic cybersecurity measures. She emphasized the potential for enhancing risk management through robust security controls and distinctions between routine cyber threats and rare catastrophic events.

Insurers are proactively safeguarding against severe risks by including exclusions for specific catastrophic events, such as nation-state attacks. Shokrai highlighted the ongoing debate among insurers on attributing cyber events to specific categories, emphasizing the importance of clarity in defining and addressing cyber risks.

Despite industry ambiguities, insurers and experts recognize the value of cyber insurance in bolstering overall security. Collaboration between insurers and businesses encourages the adoption of cybersecurity best practices, ensuring a more resilient ecosystem.

Berkshire acknowledges the potential growth of cyber insurance but remains cautious about associated risks. Jain anticipates substantial growth in the sector, albeit with potential for significant losses.

Buffett cautioned about the allure of cyber insurance, emphasizing the need for prudent underwriting practices to avoid excessive risk exposure. He suggested that contemporary optimism in the sector might overlook underlying risks, akin to what his partner, Charlie Munger, might term as ‘rat poison.’

Despite Buffett’s reservations, industry experts like Steve Griffin express confidence in the evolving cybersecurity insurance sector. Griffin notes a disparity in risk perceptions across generations and remains optimistic about the sector’s potential.