Cyber Liability Carriers Recover More From Reinsurers Than They Pay Out In Claims
Cyber liability carriers routinely recover more from their reinsurers than they pay out in claims. That sentence sounds like a scandal. It is closer to a structural feature of how quota share treaties, case reserves, and statutory reporting interact. The recoveries are real. The question is who benefits and why nobody reconciles the two sides in public.
The Cyber Premium Paradox
Primary cyber writers cede a large slice of their premium. A typical quota share treaty hands the reinsurer somewhere between 40% and 60% of the gross written premium, along with the same proportion of losses. That is not unusual in specialty lines. What stands out is how often the recoveries booked against that ceded share exceed the claims actually paid to policyholders in the same period.
Regulatory filings show the ceded ratio climbing. Carriers that once retained most of their cyber premium now pass half of it to reinsurers, and the trend has been one direction for several years. A related pattern shows up in other liability lines: this site has covered how D&O carriers cede premium to sidecar reinsurers, and the mechanics rhyme.
The gap invites scrutiny because it is visible. Anyone with a Schedule F and a claims exhibit can see recoveries running ahead of paid losses. What they cannot see, from the public filings alone, is why.
Following the Ceded Premium Trail
Quota share dominates cyber programs. Under a quota share, the reinsurer takes a fixed percentage of every policy, pays that percentage of every loss, and receives that percentage of every premium dollar. The primary carrier keeps the rest and pays a ceding commission to the reinsurer for the privilege of the arrangement.
Reinsurers book their share of premium upfront, at inception. The primary carrier books the ceded premium as a reduction to written premium and records a reinsurance recoverable on its balance sheet. Both sides are conservative about when losses arrive. That asymmetry matters more than it sounds.
Loss ratios get reported net of recoveries. When a carrier reports a 60% net loss ratio, that figure already reflects reinsurance recoveries reducing the numerator. A 60% gross loss ratio with heavy cession can become a 35% net loss ratio without a single claim being settled differently. The accounting is correct. The headline is misleading.
How Recoveries Exceed Claims
Aggregate stop-loss triggers rarely hit. A carrier buys protection against losses above a threshold, say 70% of ceded premium, and in most years the ceded loss ratio stays below that trigger. The reinsurer keeps the premium and pays nothing under the stop-loss. That is the expected outcome, not an anomaly.
Case reserves get set early and released late. An adjuster opens a ransomware claim at a conservative reserve, the carrier cedes its share, and the reinsurer books the ceded reserve as an incurred loss. When the claim settles for less, the reserve releases and flows back as a recovery. The timing of the release, not the size of the loss, drives the reported recovery.
Reinstatement premiums add to the recovery column. When a loss erodes a layer of coverage, the primary carrier pays a reinstatement premium to restore it. That payment sits in the ceded premium line and inflates the apparent recovery ratio. The carrier is buying back protection it already paid for.
The mismatch is timing. Cession happens at policy inception. Claims arrive over years. Recoveries land when reserves release, which is often after the reporting period that made the loss look large.
The Regulatory Blind Spot
Schedule F reporting lacks granularity. The schedule lists reinsurer names, ceded balances, and recoverables, but it does not reconcile ceded premium against paid losses line by line. An examiner can see totals. They cannot easily trace the flow.
State examiners focus on solvency, not flow. Their mandate is to confirm the carrier can pay claims, which means checking reserves and surplus. Whether recoveries exceed paid losses is a profitability question, and profitability questions sit outside the exam scope.
No public reconciliation of ceded premium against paid claims exists. The NAIC cyber supplement collects some data, but it does not publish a net-versus-gross comparison that would let an outside analyst see the gap directly. The information is filed. It is not assembled.
One objection holds up: reinsurance is not a slush fund. Reinsurers price these treaties expecting to pay losses over the full cycle, and a single soft year with low cat activity is not evidence of abuse. The counter is that the pattern has persisted across several years, not one.
What the Numbers Actually Show
Industry cyber loss ratios sit near 60% on a gross basis, though estimates vary by line and by how ransomware frequency is counted. Ceded loss ratios often run below 40%, because cession takes the better-performing slices and the stop-loss rarely triggers.
Recoveries boost net income. A carrier that cedes half its premium and recovers more than it pays reports a stronger combined ratio than its gross book would suggest. Shareholders see the net figure. Policyholders see the premium they were charged.
Policyholders see none of the recovery. Their premium is set at the gross level, plus expenses and a profit load. When the carrier recovers more than it pays, that surplus accrues to the carrier and its reinsurer. It does not flow back as a dividend or a rate reduction.
The trade-off is real. Heavy cession lets a small carrier write larger limits than its capital would otherwise support. A related dynamic appears in specialty property, where MGAs gain bind authority as carrier balance sheets retreat. Capacity comes from somewhere, and it is not free.
Three Actions for Watchdogs
Mandate line-by-line cession disclosure. Require carriers to report ceded premium and ceded losses for each treaty, not just aggregate balances, so an analyst can reconcile the two without guesswork.
Require recovery timing in annual statements. A recovery booked in year three against a loss from year one tells a different story than a recovery booked in the same period. The timing is the signal.
Publish net versus gross cyber loss ratios side by side. The two figures already exist in the filings. Putting them in one table would let anyone see whether recoveries are running ahead of paid claims, and by how much.
None of these actions would stop a carrier from ceding premium. They would make the flow visible, which is the minimum a market needs to price the risk honestly. The reinsurance treaty does not need to be secret. The reconciliation does not need to be an annual surprise.
Why the Gap Persists
Even with better disclosure, the gap would not close overnight. Cyber is a short-tail line in theory but a long-tail one in practice, because claims can emerge years after a breach. Carriers set reserves based on limited historical data, and reinsurers accept those reserves as the basis for recovery. The result is a feedback loop where conservative reserving inflates recoveries, which in turn makes the ceded book look more profitable than it is.
Reinsurance pricing reflects this uncertainty. Treaties often include experience accounts that adjust ceding commissions based on loss experience, but these adjustments lag by years. In the meantime, the primary carrier books the higher commission as income, and the reinsurer waits for the true loss picture to emerge. The accounting is symmetrical in theory, but the timing is not.
For brokers, the opacity creates an opportunity. They can advise clients on how to structure programs to maximize cession, knowing that reinsurers will eventually reprice. For regulators, the opacity is a challenge because they lack the tools to see the full picture. The three actions above are a start, but they require political will and industry cooperation.
The cyber insurance market is still maturing. As data accumulates and models improve, the gap between recoveries and paid claims may narrow. Until then, the structural features that allow recoveries to outrun claims will remain, and the reconciliation will stay out of public view.
This article is informational and does not constitute personalised insurance, financial, or legal advice. Consult a qualified professional about your own coverage and capital structure.
