The visual below is an illustrative cyber risk financing stack for Large / Jumbo enterprises. And maybe Mid-Size enterprises as well ???
For me, this stack visualizes a possible end-game for (re)insurers now selling cyber insurance. It reflects my point-of-view that (re)insurers should not be selling cyber insurance at all.
Each segment of the stack is, effectively, an “accordion” of cyber financial backing / risk transfer. I’ve been wondering if Risk Retention Groups might have a role to play in the cyber financing arena.
Regardless, I hope the “Insurance Cyber Coverage” segment becomes smaller and smaller as:
- cyber risks become more complex and generate combined ratios over 100%;
- tail losses from existing cyber insurance coverage on the books become more apparent (and generate more costly losses than initially planned as well as combined ratios over 100%);
- systemic cyber risks become much more frequent (with associated severity) and generate combined ratios over 100%;
- cyber warfare becomes better defined (and excluded from the cyber insurance coverage which (re)insurers sell.

Comments – and corrections – are welcome.