Is the fear of cyber war holding back billions? Tom Johansmeyer, Global Head of Index Classes at Price Forbes Re, made a compelling argument at the 2025 Convergence event in Bermuda. He suggests that the insurance industry's perception of cyber warfare is significantly overblown, creating unnecessary anxiety that's actually stifling market growth and preventing capital from entering the cyber insurance space.
During a panel discussion, Johansmeyer boldly stated that the industry's view of cyber war is largely unsupported by concrete evidence. He's even preparing to submit this perspective as part of his doctoral research. He pointed out that cyber war is often excluded from coverage, questioning the rationale behind this decision. "War is a huge element of cyber risk," he explained, highlighting the industry's cautious approach.
He further elaborated on the perceived risks, describing cyber war as an event designed to cause maximum disruption, making risk transfer seem impossible. But here's where it gets controversial... Johansmeyer believes this fear is creating a self-fulfilling prophecy. The industry's exaggerated view of cyber war, he argues, isn't consistent with historical data or real-world experiences. For instance, he referenced the 2022 invasion of Ukraine, where cyberattacks, despite being present, weren't as devastating as feared.
According to Johansmeyer, this fear is directly impacting market dynamics. The industry's messaging around cyber war is scaring off potential investors. Conservative investors, wary of potential industry-wide catastrophes, are hesitant to invest in cyber insurance. They'd rather 'wait for the big one,' as he put it, hindering the development of the cyber insurance market.
He stresses that cyber insurance could become a much larger business, but only if the industry encourages new capital to enter. This involves fostering a more realistic understanding of the risks involved. Reinsurers need to embrace volatility, and insurers are increasingly seeking more comprehensive coverage options, like XoL coverage and aggregate protection. They want more event coverage and less quota share.
Looking ahead, Johansmeyer sees potential for insurance-linked securities (ILS) in the cyber risk market. He believes the market is maturing and refining its approach to pricing and risk assessment. He notes that the ILS market has stepped in and used these structures as the cat bonds showed. However, he also questions if this is the right role for the ILS market and if it might be better served when reinsurers have taken on more of the volatility, creating enough real volume in the reinsurance market for that retro use case to come in for the ILS space. He would be interested in current cyber cat bonds if he were in an ILS fund today, but noted that prices and attachment points need to come down. He suggests that the industry should spend more time outside its 'echo chamber.' He adds that security stakeholders in cyber have a much different view of the risk than the industry does.
What do you think? Do you agree that the fear of cyber war is overblown? Is the industry's cautious approach justified, or is it hindering progress? Share your thoughts in the comments below!
