Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Are Using Cyber Reinsurance to Cap Catastrophic Loss
Transcript
- Lucas: So you're a CISO at a mid-size manufacturer, and you've done everything right — multifactor authentication, endpoint detection, even a zero-trust network. Then a ransomware gang hits you through a third-party vendor, and the ransom demand is twenty-five million dollars. Your cyber policy has a fifty-million limit, so you think you're covered. But the insurer's lawyers find a sub-limit on vendor-related claims, and suddenly you're looking at a payout of eight million. Luna: That's the gap that keeps CISOs up at night. And it's exactly why the conversation has moved from 'what's my policy limit' to 'who's actually backing that limit.' Lucas: Right. And that's where cyber reinsurance comes in. In the simplest terms, it's insurance for insurance companies. A primary insurer — the one that sells you your policy — buys its own coverage from a reinsurer to cap its exposure on a block of policies. So if a single event like that ransomware attack blows through the primary's risk appetite, the reinsurer steps in and pays the excess. Luna: It's been standard in property and casualty for decades. But on the cyber side, it's only really matured in the last few years. Lucas: Exactly. And the numbers have gotten big. In 2025, global cyber reinsurance premiums reached roughly seven billion dollars, up from around four and a half billion just three years earlier. That's a compound annual growth rate north of fifteen percent. And the Federal Insurance Office — that's the Treasury arm that tracks these markets — published a report earlier this year that said cyber reinsurance capacity has become a critical component of the primary cyber insurance market. They're essentially saying the whole edifice leans on that layer. Luna: So when a big claim hits, it's not just the insurer you bought from that pays. It's a whole chain of capital behind them. Lucas: Exactly. And that chain is what we're going to unpack today. How that reinsurance layer actually works, why it's changing how CISOs talk about risk, and why there's a growing debate about whether the federal government needs to step in as the ultimate backstop for a truly catastrophic cyber event. Luna: Let's start with the mechanics. How does a primary insurer decide how much reinsurance to buy? Lucas: It's a capital allocation question. The insurer's own risk appetite — how much they're willing to lose on a single event or in a year — determines their retention. That's the amount they keep on their own books. Above that, they buy reinsurance. So you might see a primary insurer that retains the first fifty million of any single cyber loss, then buys a reinsurance layer that covers from fifty to two hundred million. And beyond that, there may be another layer, often from a different reinsurer. Luna: So it's like a stack of protection. Each layer takes on the risk above the previous one. Lucas: Exactly. And because cyber is so correlated — think about a cloud provider outage that takes down thousands of insureds at once — reinsurers are nervous about aggregation risk. They're trying to model how much they could lose if a single event, like a widespread ransomware campaign or a cloud disruption, hits many policies at the same time. That's why cyber reinsurance pricing is so volatile. Reinsurers have been raising rates and tightening terms because they still don't have decades of loss data to rely on. Luna: And that's where the actuarial challenge is. How do you price something that hasn't happened at scale yet? Lucas: It's the fundamental problem. Unlike hurricanes, we don't have a hundred-year history of cyber catastrophes. So reinsurers are increasingly using parametric triggers instead of traditional indemnity-based claims. With indemnity, the reinsurer pays based on the actual loss you've incurred. With parametric, they pay a fixed amount if a defined event happens — like a ransom demand above a certain threshold, or a large-scale outage at a major cloud provider. Luna: Parametric is appealing because it's faster and less subject to legal disputes. You don't have to prove the exact dollar loss. Lucas: Right. And that speed matters. After a ransomware attack, waiting months for a loss adjuster to quantify the damage can be crippling. Parametric triggers pay out within days or weeks, which gives the enterprise immediate liquidity to hire incident response teams, negotiate with the attackers, or just keep operations running. The trade-off is that the payout might not perfectly match the actual loss. But for many CISOs, speed is worth more than precision. Luna: So how does this trickle down to the enterprise buyer? Is my insurance company's reinsurance arrangement something I should even care about? Lucas: You should care a lot. Because it directly affects your premiums, your policy terms, and even whether your claim gets paid. If a primary insurer can't get affordable reinsurance, they have two options: raise premiums or reduce capacity. And we've seen both. In 2024 and 2025, a lot of primary insurers started offering lower limits to their customers because they couldn't buy enough reinsurance themselves. Luna: So the reinsurance market is effectively setting the ceiling on what a company can buy. Lucas: Exactly. And that's why you've seen more enterprises, especially those with sophisticated risk teams, starting to buy their own reinsurance directly. They're not just relying on the primary policy anymore. They're going to a specialist and buying excess coverage, above the primary limit, that is triggered by a specific type of event. It's called 'excess of loss' coverage, and it's becoming a hot product. Luna: Interesting. So the CISO is becoming a buyer of capital markets products. Lucas: In some cases, yes. There's a whole ecosystem of insurance-linked securities — catastrophe bonds and sidecars — that are being used for cyber risk. These are instruments where investors put up capital, and if a defined cyber event occurs, they lose some or all of it, and the insured gets paid. It's a way to bring pension funds and other institutional capital into the cyber risk pool. Luna: That's a big shift. A decade ago, cyber risk was seen as uninsurable because it was too hard to model. Now it's being securitized. Lucas: And it's working, but there's a limit. The reinsurance market can handle a few billion dollars in losses. But a truly catastrophic event — say, a massive cloud outage that takes down a significant chunk of the global economy — could produce losses in the tens of billions. That's where the question of a federal backstop comes in. Luna: Like what happened with terrorism insurance after 9/11. The government stepped in because private insurers refused to cover that risk. Lucas: Exactly. The Terrorism Risk Insurance Act was passed in 2002 to create a federal backstop for terrorism claims. And there's now a growing coalition of insurers and business groups pushing for something similar for cyber. They argue that a catastrophic cyber event could destabilize the economy, and private capital alone can't cover it. The Federal Insurance Office report I mentioned earlier actually said that a federal backstop 'merits further consideration.' Luna: But there's also a concern that a federal backstop would create moral hazard. If companies know the government will bail them out, they might underinvest in security. Lucas: That is the classic argument against it. And it's why any proposed legislation includes strict conditions — like requiring companies to meet minimum security standards to qualify. The debate is still in its early stages, but it's heating up. In fact, just last week, a bipartisan group of senators introduced a discussion draft that would create a Cyber Catastrophe Reinsurance Program, modeled on the terrorism backstop. It's got a long way to go, but it's a signal that Washington is taking this seriously. Luna: So what does this all mean for a CISO in the trenches? How should they be thinking about reinsurance when they're buying coverage? Lucas: First, ask your broker about the insurer's own reinsurance program. Are they buying from top-tier reinsurers? What's their retention? How much of their cyber book is backed by third-party capital? That tells you about their stability. Second, consider whether you need excess coverage above your primary limit, especially if your risk profile is complex. And third, think about parametric products as a complement, not a replacement, for indemnity insurance. Luna: And I'd add one more thing — start talking to your finance team about this in actuarial terms. Because the CISO who can model their own aggregate loss potential is the CISO who can have a real conversation with a reinsurer. Lucas: That's the key. The security leader who can speak the language of capital markets is going to be the one who gets the best terms. And it's also changing the internal conversation. Instead of just 'what's our risk,' it's 'what's our risk-adjusted cost of capital?' Luna: That's a much more sophisticated view. And it's something that even five years ago was rare in a security department. Lucas: Absolutely. And it's a great example of how the security function is evolving into a core business discipline. Those of us who've been in this space for a while have seen it go from 'we install antivirus' to 'we allocate capital against cyber risk.' It's a fascinating evolution to watch. Luna: It really is. And if you're building or running something in this space, these conversations are part of what we hope you get out of the show. A couple of dollars a month genuinely keeps these episodes going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Lucas: Yeah, it's the kind of support that keeps us ad-free and independent. And it's just a cup of coffee, really. But it adds up, and it lets us keep digging into topics like this one. Luna: And we can't cover this stuff without it, so thank you. Lucas: Now, let's get back to the federal backstop question, because that's where the future of this market is going to be decided. The debate is still open, but there's a real possibility that within a few years, we'll see some form of government-backed cyber catastrophe insurance. That would be a game-changer for every enterprise that relies on cyber insurance. Luna: And it would also change the calculation for every CISO. Because if the government is the ultimate backstop, then the security standards that come with it become de facto regulation. Lucas: Exactly. That's the direction we're heading. So if you're a CISO, start thinking now about how you'd respond to mandatory security baselines tied to insurance. That's a conversation that's coming sooner than you think. Luna: And it's not just for the Fortune 500. Even mid-market companies are going to feel it, because the insurance market is national — if not global — and these changes ripple through. Lucas: Right. And that's the thing about cyber reinsurance — it's a quiet market, but it's the invisible backbone of your cyber defense. So next time you renew your policy, ask your broker about the reinsurance layer. It might be the most important question you ask all year. Luna: And we'll be here to break down whatever comes next.