Who Absorbs the Risks Private Insurance Cannot?

Commercial cyber insurance can cover many measurable losses, but it cannot automatically diversify a failure that reaches thousands of firms through the same dependency. This chapter compares the layers that sit beyond an individual policy—reinsurance, insurance-linked securities, public-private pools and government backstops—and connects them to supervisory governance. It also uses artificial intelligence as a forward-looking test: can the same technology that accelerates attacks and correlated decisions also improve defence, underwriting and oversight?

The comparison is not a search for one winning layer. Each layer answers a different question. Commercial insurance transfers a defined loss from a firm to an insurer. Reinsurance transfers part of the insurer’s exposure. Capital-market instruments add investors with different risk-bearing capacity. A public-private arrangement can absorb a residual catastrophe that private markets cannot diversify. The value of a layer depends on what it can measure, how much correlation it can withstand, who retains the first loss, and what incentives remain after the transfer.

The private market has an outer boundary

A commercial insurer is most comfortable with a risk that can be described, priced and limited. The policyholder pays a premium in exchange for a defined promise. The insurer retains the exposure within its risk appetite and capital plan, and can use deductibles, sub-limits, exclusions and coinsurance to keep the possible payment within bounds. This structure can work for many firm-level events and for some catastrophic risks that remain sufficiently quantifiable.

It becomes harder when the loss is both large and correlated. A state-sponsored cyber attack, cyber terrorism or a breakdown of critical infrastructure may affect many organisations at once and may not be easily diversified. The cost may exceed an insurer’s risk-bearing capacity, while attribution and coverage questions remain unsettled. Calling such a risk “uninsurable” should be understood as a conditional judgement about measurability, diversification and capacity—not a permanent statement that no future design could cover any part of it.

The first layer is therefore not a promise to cover everything. It is the firm’s own resilience and retained loss. A company can reduce the probability or severity of an event through controls, redundancy, segmentation, backups, recovery planning and supplier oversight. It can retain a deductible or loss that falls below the policy limit. It may decide to spend on an alternative provider rather than purchase a larger limit. These choices do not eliminate systemic exposure, but they can reduce the amount that reaches the next layer.

The second layer is commercial cyber insurance. Its strength is specificity: a policy can fund incident response, restoration, interruption or liability under defined conditions. Its weakness is that a shared event can activate many policies together, including policies outside the dedicated cyber book. Limits and exclusions can protect the insurer, but they also leave the policyholder with residual risk. A clear limit is preferable to an unknown exposure, yet clarity does not create capacity that is not available.

The third layer is reinsurance. A primary insurer cedes part of its exposure to a reinsurer, which can allow the primary insurer to write more business or manage its capital more effectively. The BIS Financial Stability Institute report says that approximately 50% to 75% of global cyber-insurance premiums were ceded to reinsurers over 2022–24. EIOPA reports that inward reinsurance accounted for 40% of EEA earned cyber premiums in 2024, a larger share than the 27% reported for non-life insurance overall.

These figures show that reinsurance is not a peripheral technical arrangement. It is part of the capacity structure of cyber insurance. It can spread a primary insurer’s losses and bring specialist capital and underwriting knowledge to the market. But the risk is not gone. If many cedants have insured firms that depend on the same cloud provider or software platform, one event can create claims across several reinsurance contracts.