Cyber catastrophe risk and cat bonds

What cyber catastrophe risk is, how insurers and reinsurers protect themselves against accumulation and how cyber cat bonds work: triggers, the main issues from 2023 to 2026, pricing, limits and outlook.

A single cyber attack can hit thousands of companies on the same day. For a cyber insurer, this is the scenario that really matters, more than isolated claims. Cat bonds, bonds that transfer catastrophe risk to investors, are one of the tools the market uses to try to make it sustainable.

This article looks at what cyber catastrophe risk is, how insurers and reinsurers protect themselves against it and how cyber cat bonds work, with market data updated to 2026.

What cyber catastrophe risk is

Cyber catastrophe risk is an event that generates simultaneous losses across many insureds and many insurers. In property, the cause is a hurricane or an earthquake; in cyber, it is self-propagating malware, the compromise of widely used software or the outage of a technology provider on which thousands of businesses depend.

The difference from natural catastrophe risk is that cyber has no geographical boundaries. Two companies on different continents can be hit by the same event if they use the same cloud or the same software. That is why the central problem is accumulation: the sum of correlated exposures in a portfolio.

Some recent cases show the scale of the phenomenon:

NotPetya (2017): it was the first event included in the cyber catastrophe index of PCS (Verisk), with an estimated insured loss of 3 billion dollars (Artemis). Many property and casualty insurers rejected claims by invoking the war exclusion (Carnegie Endowment).
MOVEit and Change Healthcare: both designated by PCS as Cyber Catastrophe Loss Events.
CrowdStrike (2024): the global IT outage was also classified as a catastrophe event, with expected insured losses above 250 million dollars. Parametrix estimated a range between 540 million and 1.08 billion (Artemis).

To fall into this category according to PCS, the event must hit several insureds and several insurers. The CrowdStrike case also confirms that a cyber catastrophe does not require an attack: an error in a software update is enough.

How companies and insurers protect themselves

Protection against catastrophe risk works in layers: each level retains part of the loss and passes the rest to the next.

The company reduces the likelihood and impact of incidents through cybersecurity, continuity plans and supplier management. It retains part of the loss through deductibles and limits.
The primary insurer selects risks, applies sublimits and exclusions (for example war and critical infrastructure outage) and monitors the accumulation in its own portfolio.
The reinsurer takes a share of the portfolio through proportional treaties or protects the insurer against peak losses with excess of loss covers.
The retrocessionaire in turn protects the reinsurer.
Capital markets absorb the highest and least likely layers through Insurance-Linked Securities, of which cat bonds are the main form.

The last level is the newest in cyber. It exists because traditional reinsurance capacity alone might not be enough for an extreme event. An example: Beazley reports more than 1 billion dollars of cyber excess of loss protection, of which 670 million obtained through cat bonds (Beazley).

What cat bonds are

A cat bond is a bond that the investor loses, in whole or in part, if a catastrophe defined in the contract occurs. In exchange, the investor receives a higher return than on an ordinary security.

The mechanism involves three parties:

The sponsor (insurer or reinsurer) seeks protection and pays a premium.
A dedicated vehicle (SPV), usually based in Bermuda, enters into a reinsurance contract with the sponsor and issues the bonds.
Investors (ILS funds, pension funds, asset managers) buy the bonds. The capital raised is held in a collateral account and invested in low-risk securities.

As long as the event does not occur, the investor collects the premium plus the return on the collateral and gets the capital back at maturity. If the event occurs, the collateral is used to pay the sponsor. The advantage for the sponsor is fully collateralised cover, with no credit risk on the counterparty, and often multi-year.

The element that decides whether and how much is paid is the trigger:

Indemnity: pays on the sponsor's actual losses. Precise cover, but slow settlement.
Industry loss: pays on the estimated loss of the whole market. More transparent for the investor, but the sponsor bears basis risk.
Parametric: pays when an objective threshold is exceeded (for example the hours a cloud is unavailable). Fast payment, but it can diverge from the actual loss.

Basis risk is the difference between what the bond pays and the sponsor's actual loss. A 2026 Princeton study argues that for cyber the best solution is a combination of indemnity and parametric triggers (Princeton).

Cyber cat bonds

The first cyber cat bonds arrived in 2023, first as private placements and then, in the last quarter of the year, as 144A issues for the institutional market (Appleby). According to AM Best, the capacity of 144A cyber cat bonds grew from 785 million dollars at the end of 2024 to 1.235 billion at the end of 2025 (Artemis).

The main issues show how the market has experimented with different structures:

Beazley, PoleStar Re 2026-1, 300 million dollars: the largest so far; the first with three sub-layers, cover until the end of 2028.
Chubb, East Lane Re 2026-1, 150 million dollars: the first cyber cat bond in annual aggregate form.
Hannover Re, Cumulus Re 2026-1, 35 million dollars: parametric trigger on cloud outage.
AXIS, Long Walk Re 2024-1, 75 million dollars: per-occurrence indemnity on systemic events.
Swiss Re, Matterhorn Re 2023-1, 50 million dollars: the first with an industry loss trigger, with a threshold of 9 billion dollars of US market loss.

On pricing, the premium investors demanded for novelty has largely eroded, according to Gallagher Securities (Artemis). Multiples nevertheless remain higher than those of property cat bonds, whose weighted average in 2025 was 2.97 according to AM Best.

Limits and outlook

Cyber remains a niche of the cat bond market. In June 2026 the overall market was worth 65.6 billion dollars (Artemis), and cyber accounts for 1.3% of it. In new 2026 issuance its share fell to 0.19%.

According to S&P, no new sponsors entered in 2026, while AXIS and Swiss Re did not renew their public issues (Artemis). There are three main obstacles:

Event definition: establishing when several incidents make up a single cyber event is still under discussion.
Modelling: the historical series is short and the risk changes quickly with technology and attack techniques.
Exclusions: war, critical infrastructure and aggregation must be consistent across policy, treaty and bond, otherwise basis risk arises.

The outlook remains positive. Beazley has announced that from 2026 it will also move into the securitisation of cyber risks with a dedicated ILS fund (Beazley). S&P notes that, if traditional reinsurance capacity were to shrink, cyber ILS could grow quickly.

Conclusions

Cat bonds do not replace prevention or traditional reinsurance: they sit at the last level of the chain, where the event is rare but potentially destructive. In cyber they have already shown they can work with different triggers and increasingly sophisticated structures. Their growth will depend on three factors: more reliable models, shared event definitions and a cyber insurance market large enough to generate stable demand for capacity.

For insured companies the message is indirect but concrete: a stronger risk transfer chain means more stable insurance capacity, even after a major event.