Unfortunately, discussion of the topic has been dogged by competing definitions and widely varying estimates of the gap’s size and importance.
Michael Millette, managing partner at Hudson Structured Capital Management and a leading light in the development of the catastrophe bond market, aligned himself with the most bullish projections of cyber market growth in a report published in December by cyber risk modelling company CyberCube. “The pathway is being laid to create half a trillion [dollars] of cyber coverage,” he wrote.
If so, that is just as well because estimates of the cyber protection gap – the extent to which insurance fails to cover cyber losses – are huge and do not appear to be shrinking, even given the recent rapid growth of the cyber insurance market. Last March, the Global Federation of Insurance Associations (GFIA) estimated the cyber protection gap in 2021 at around $900bn, with insurers covering just $6bn in losses, or less than 1 percent of the total.
Few topics are as widely discussed in the insurance market as protection gaps. The largest gap in commercial lines is for cyber risk, but gaps in the personal lines market for risks such as flood and earthquake are also often huge. Protection gaps vary enormously by country. They include risks that people have knowingly left uninsured as well as risks they mistakenly believe are insured. Large protection gaps can call into question the relevance of insurance, but they can also spur demand.
Closing, or at least narrowing, protection gaps between insured and uninsured losses is often presented as an example of insurers fulfilling their social role – particularly in relation to natural catastrophe risks. But there is no consensus on how they should be measured.
The simplest definition, most commonly used, is the gap between insured and economic (i.e. total) losses from an event. Swiss Re, Munich Re, Aon and Gallagher Re all publish sizeable figures for natural catastrophe protection gaps, thus defined. According to Gallagher Re, the global nat cat protection gap in 2023 was $234bn. Swiss Re and Munich Re pegged it at $160bn and $155bn, respectively.
But such estimates are of limited value in assessing socially desirable levels of insurance. Closing these gaps completely would be undesirable due to the insurance industry’s high expense load. The average expense ratio for US P&C business in 2022 was 25.7 percent, according to AM Best, and is often higher in other markets. Expenses at Lloyd’s – a major provider of catastrophe insurance and reinsurance capacity – were 34.4 percent of earned premiums in 2022. So if the nat cat protection gap was closed, the world would in most years be paying out vastly more to insure against natural catastrophes than those catastrophes would otherwise cost.
“A certain level of risk retention makes economic sense,” Kai-Uwe Schanz, now deputy managing director at industry think tank the Geneva Association, observed in a paper he authored for the organisation in 2018. “The most appropriate definition of insurance protection gaps is the difference between the amount of insurance that is economically beneficial and the amount of coverage actually purchased.”
However, Schanz noted that this more appropriate definition is both “hard to measure and subjective”, which is why the simpler, but less useful, measurement is often preferred.
The Mapfre Foundation, established by the Spanish insurance company, has also grappled with these measurement challenges. For the past five years it has published a Global Insurance Potential Index, which it describes as “a global vision of the potential for closing the insurance gap”.
Mapfre compares the performance of national insurance markets against a benchmark that it uses to calculate “the difference between the insurance coverage that would be optimal and beneficial to society and the actual insurance coverage purchased in a country”. The benchmark is set at the 90th percentile of the insurance penetration distribution (relative to GDP) for the 96 countries that Mapfre analyses, meaning that a few countries will exceed it, while most will fall short.
In 2022, the non-life insurance markets of the OECD countries as a group exceeded Mapfre’s benchmark by 8 percentage points. By contrast, the BRICS (Brazil, Russia, India, China and South Africa) only attained 41 percent of the benchmark insurance penetration. Mapfre rated China as having by far the largest insurance growth potential.
Overall, Mapfre calculated the global non-life insurance protection gap in 2022 to be $2.412trn or approximately 2.4 percent of global GDP. (This was dwarfed by its estimate of the protection gap for life assurance, which came in at $5.401trn or around 5.4 percent of global GDP.) The BRICS and other emerging economies accounted for 77.6 percent of the total life and non-life protection gap.
By Mapfre’s calculations, the world’s largest non-life insurance market, the US, does not have an overall insurance protection gap. But in certain sectors of the US market, large gaps continue to yawn. A study by Guy Carpenter of the global cyber market published in June 2023 found that, although cyber insurance has a longer history in the US than elsewhere, its penetration as a share of total non-life premiums is lower than in many other countries.
In cyber, the difficulty of quantifying protection gaps is extreme because the risk is evolving so fast and the insurance market is evolving with it. This interdependent evolution makes it difficult to tell whether rapid growth of the global cyber market – projected by Munich Re to double in size between 2022 and 2025 – is making much of a difference to the overall protection gap.
The US is widely regarded as the world’s most mature cyber insurance market. But Guy Carpenter’s study revealed that, while US insurers had been writing substantially more cyber insurance premium, they had often been trimming the coverage offered. The US cyber policies represented in Guy Carpenter’s extensive cyber database often provide narrower coverage across almost every category of risk than the international policies in the same database.
Quantifying the total value of cyber losses is also fraught with difficulty. Particularly hard to pin down are the costs of customer churn – the amount of business a firm is expected to lose as a result of reputational concerns stemming from a cyber attack.
IBM’s 2023 Cost of a Data Breach report, a widely quoted study, argued that “lost business” accounted for more than a quarter (27 percent) of the total average global cost of data breaches surveyed between March 2022 and March 2023. IBM and its research partner, the Ponemon Institute, computed the average global data breach cost at $4.45mn, while the average cost in the US was estimated to be more than twice as high, at $9.44mn.
If a business were to take such a large hit in the event of a data breach, the share price of the company affected might also be expected to suffer. But the share prices of public companies do not in general show a material downturn in the wake of a breach, according to a detailed study conducted at Stern Business School in 2020. It is possible that investors are more sanguine about the impact of data breaches on customer loyalty and sales than cybersecurity vendors are.
In some markets, quantifying protection gaps with any semblance of statistical rigour is even harder. An example is excess liability insurance, which features in Chubb’s 2023 North American wealth report, subtitled “closing the protection gap in a time of increasing risk”. To compile the report, Chubb interviewed 800 wealthy individuals in the US and Canada, more than 90 percent of whom had investable assets in excess of $1.5mn.
The insurer notes that nine out of 10 respondents to its survey voiced concern about the size of a verdict against them if they were to be a defendant in a liability case, “yet only about one in three (36 percent) say they have excess liability coverage”.
But how much excess liability coverage is enough? “Calculating the right amount of liability coverage is notoriously difficult,” acknowledges John Quinlan, a wealth manager quoted in Chubb’s report. In the absence of meaningful statistics, Chubb – like many insurers – resorts to anecdote, citing “a client at a yoga studio [who] fell onto the person next to her while doing a downward dog and was sued by the injured yogi for pain and suffering”.
The US excess liability market presents in an acute form an issue that is common to all protection gaps, real and imagined. Insurance should cover risks that the insured cannot otherwise readily afford. But how much can a wealthy individual afford? Individual circumstances vary widely.
Other gaps may well be larger but are less well publicised. For many years now, evidence has been building that US homeowners, despite their best efforts to maintain adequate coverage, are frequently underinsured for events leading to the total loss of their homes. Most homeowners never suffer the consequences of these gaps because total losses are rare. But the mounting incidence of wildfire losses in many western states offers some insights into the problem.
After the devastating 2021 Marshall Fire in Colorado, the state’s insurance regulator sought to quantify the frequency and depth of underinsurance. It found that it was widespread, particularly for higher-value homes. Over a third of homes with rebuild costs of $250 per square foot were underinsured, as were more than half of homes with rebuild costs of $300 per square foot and more than two-thirds of homes with rebuild costs of $350 per square foot.
In a paper due to be published shortly in the Connecticut Insurance Law Journal, Kenneth Klein, a law professor at California Western School of Law, argues that point-of-sale algorithms used widely by insurers to calculate replacement costs for housing frequently underestimate the true value of people’s homes. Analysing extensive wildfire loss data for 2018 and 2019 obtained by the California Department of Insurance from 76 insurers representing 98.8 percent of the state’s homeowners insurance market, he concludes:
“Point-of-sale estimates of the cost of reconstruction … underestimate the cost of reconstruction at least three-quarters of the time and when underestimates occur, they are, on average, at least one-third too low.”
If, as is widely expected, climate change continues to add to the frequency and severity of natural catastrophe perils, the homeowners underinsurance problem will likely worsen. Klein observes that “a lot of money is on the line”, citing a 2021 estimate from the Insurance Information Institute that, in the Gulf and Atlantic states, over 7.3 million single-family homes faced moderate to extreme hurricane wind risk, with a cumulative reconstruction value of over $1.8trn. Homes built in so-called wildland–urban interface regions, where most wildfires occur, increased in number from 30 million in 1990 to 44 million in 2020, census records show.
Underinsurance creates a protection gap that only emerges in the event of a claim for a loss. But most gaps derive from people buying no insurance at all. This should not be surprising, as insurance is a balancing act that depends on a particular confluence of demand and supply conditions. Insurers and their customers must thread a needle, with risks needing to satisfy numerous conditions before they can be insured. The GFIA in its report on protection gaps identifies no fewer than seven “insurability criteria”
In light of these demanding criteria, it is inevitable that protection gaps will emerge and grow in certain insurance markets at certain times. But insurance buyers might still benefit from greater rigour in measuring them.
For continued access to market leading content click here to enquire about a subscription to The Insurer - your company may already have a corporate subscription in place…
Scan here to download the app