Remote and hybrid work arrangements post Covid have made cyberattacks easier and more attractive for cybercriminals as a result of which insurance costs for protection against such eventualities have increased.

Moody’s Investor Services estimates that the total prremium paid for protection against cyber frauds and ransomware attacks have increased to $1.6 billion in 2020 from $1.2 billion 2019. However, increasing ransomware attacks have also led to a jump in loss ratio to 65% in 2020 from 44% in 2019.

Moody’s said that entities that fail to adapt will be at the most risk with risks rising across the board during periods when organizations transition to new cybersecurity procedures. Also, reduced cyber security coverage will have a negative impact on the credit profile of companies.

“The post-pandemic surge in ransomware attacks is responsible for increased cyber insurance premiums across all sectors globally, as well as shrinking coverage for the industries most heavily targeted in these attacks. Reduced cyber insurance coverage is credit negative for affected entities because it restricts the availability of funds to mitigate the financial impact of cyberattacks and makes it more expensive to connect with products and services to improve cyber resiliency,” Moodys said.

The higher loss ratios increase further to 73% in 2020 from 47% in 2019 when defence costs are included, eroding profitability for insurance companies.

“Assuming an average expense ratio of 30%, the estimated combined ratio – incurred losses and expenses as a share of premiums for standalone cyber insurance was above 100%, meaning the product was not profitable. Cyber insurance sold as part of a package, however, still generated an underwriting profit in 2020,” Moody’s said.

Aa a result to protect profitability, insurers have raised cyber insurance premiums substantially.

For example, insurance broker Marsh & McLennan Companies, Inc. (Baa1 stable) reported second-quarter 2021 premium increases of 56% in the US, 35%-40% in the UK, and 20%-30% in Latin America, and sizable increases in continental Europe and Asia-Pacific.

“Premium increases have been the starkest for entities in the industries most targeted by ransomware attacks. In the US, entities in education, government, healthcare, construction and manufacturing have been subject to premium hikes of 300% or more, according to insurer Risk Placement Services Inc,” Moody’s said.

Despite the increase in premiums, adoption of cyber insurance continues to climb as companies see it as an essential part of their security.

“Marsh reported that the global percentage of its insureds with cyber insurance rose to 47% in 2021 from 26% in 2016. For industries that are frequent ransomware targets, insurance coverage is also now less comprehensive,” Moodys said.

Besides, limiting financial impact cybersecurity insurers also serve as facilitators for their customers, arranging tools to create, test and evaluate incident response plans, vulnerability email alerts, external vulnerability monitoring, network security, identity and access management and educational tools and also post-breach services, in which insurers connect insureds with cybersecurity professionals who guide them through responding to a cyber incident.

“Without cyber insurance, issuers must arrange these services themselves and may find it more challenging to identify and connect with vetted support services in a timely fashion,” Moodys said.