Solvency II Tested by Cyber Risk

II.Cyber, a Risk with Two Faces

The risk the insurer bears

Before being a product it sells, cyber is first a risk the insurer bears in its own operations. An insurer is a heavily digitized business, and its policy administration, pricing, claims and personal-data systems are all attack surfaces. An intrusion, a ransomware attack or a cloud outage can halt its business, compromise policyholder data and expose it to liability. In the prudential taxonomy, this risk falls under operational risk, that is, the risk of losses resulting from a failure of procedures, people, systems or external events.

The risk the insurer sells

Cyber is also a risk the insurer knowingly takes onto its balance sheet by writing cyber policies, whether affirmative cover or implicit cover sitting in traditional contracts, the silent cyber discussed in an earlier article in this series. This cyber underwriting risk has grown rapidly. Munich Re estimated the global cyber insurance market at 15.3 billion dollars in premiums in 2024, less than 1% of the property and casualty market, and anticipated a doubling by 2030 at an annual rate above 10%¹. Geographic concentration remains strong, with North America accounting for about 69% of premiums and Europe for 21%¹. The prudential question is then how Solvency II captures these two faces of cyber, the one the insurer bears and the one it sells.

III.The Blind Spots of the Standard Formula

An operational risk treated as a flat charge

The treatment of the cyber risk borne by the insurer illustrates the crudeness of the operational risk module of the standard formula. This capital is calculated on a flat-rate basis, by applying factors to bases such as earned premiums and technical provisions, with no sensitivity whatsoever to the actual quality of the entity's cybersecurity. A company with state-of-the-art protection and a negligent company are charged the same amount, provided their volumes are comparable. More constraining still, this operational capital is capped at 30% of the basic Solvency Capital Requirement². Operational risk, and therefore the cyber risk it harbors, can thus never represent more than a conventional fraction of the total requirement, regardless of actual exposure. The formula thus treats operational risk as second-order, an assumption that gets harder to defend with every systemic cyber event.

An underwriting risk without a dedicated module

The cyber risk sold by the insurer suffers from a symmetrical blind spot. The standard formula contains no specifically cyber underwriting module. The exposure is diluted within the non-life underwriting module, inside premium and reserve risk, calibrated on generic sectoral factors, and the non-life catastrophe module, which details sub-modules for natural catastrophes and for certain man-made catastrophes such as fire or marine risks, provides for no cyber catastrophe scenario. Yet it is precisely the catastrophic dimension, that is, the accumulation of a large number of claims triggered by a single event, that constitutes the central danger of cyber insurance. The standard formula therefore measures cyber risk with instruments designed for risks of a radically different nature.

The silent residue

To these two blind spots is added the persistence of silent cyber, that is, non-affirmative cyber exposures lodged in traditional policies. The contractual clarification imposed by the London market's LMA bulletin 21-042, analyzed in an earlier article, has no binding regulatory equivalent on the continent, where EIOPA confined itself in 2022 to recommendations on the management of non-affirmative cyber and its exclusions³. A residual cyber exposure, poorly tracked and therefore poorly capitalized, thus remains scattered across European property portfolios, escaping by construction any dedicated prudential measure.

IV.Accumulation, the Breaking Point of Modularity

When correlation ceases to be a stable parameter

The deepest flaw lies in the modular logic itself, which does not fit cyber risk, far more than in the absence of this or that module. The standard formula assumes moderate and stable correlations between risks. Cyber frontally violates this assumption, because a single systemic event can simultaneously trigger correlated losses across an entire underwriting portfolio, across the operational functioning of the insurer, and even across its financial assets if the event disrupts markets. The NotPetya attack of 2017 and the CrowdStrike incident of 2024, both examined in this series, showed that a single technical cause could strike tens of thousands of organizations within a few hours, shattering the independence of claims on which risk pooling rests.

This tail correlation, that is, the fact that risks become strongly dependent precisely in extreme scenarios, is the Achilles' heel of any aggregation-based approach. The correlation matrices of the standard formula are calibrated on average conditions and structurally underestimate the dependence that manifests itself in catastrophe. The diversification benefit the formula grants then becomes an accounting illusion, because the assumed diversification disappears at the very moment the insurer would need it most. A major cyber event turns an apparently diversified portfolio into a single concentrated exposure.

Internal models, a partial answer

Large cyber insurers rely on internal models, which in principle allow a finer representation of accumulation, through the simulation of systemic scenarios and the explicit modeling of dependencies. This path nonetheless runs into an irreducible difficulty, the scarcity and instability of data. Where fire or motor risk draws on decades of stationary history, cyber risk evolves faster than data accumulates, as the attack surface, offensive techniques and dependence on the same critical providers transform from one year to the next. The internal model therefore shifts the problem without solving it, substituting for the absence of a module a dependence on proprietary models whose calibration rests on fragile assumptions that are difficult for the supervisor to verify.

V.The Regulatory Response, Seeing Before Pricing

Making the risk visible

Unable yet to put a capital number on the risk, the European regulator chose to make it visible before pretending to price it, which is the right order. The Solvency II review thus introduced a specific prudential reporting template, template S.14.03 on cyber underwriting risk, which requires the non-life insurers concerned to report their cyber exposure in a granular manner, by product group⁴. This template falls under the third pillar, that of transparency, and not the first, that of capital. It creates no additional charge, but it provides the supervisor with a map of the market's affirmative cyber exposure, an indispensable precondition for any future calibration.

Testing the risk through scenarios

EIOPA has in parallel developed a stress-testing methodology specific to cyber, published in 2023, which defines underwriting scenarios such as a widespread cloud outage, a wave of ransomware or a prolonged power cut, to be applied at the granular level of products and policyholders⁵. Cyber underwriting risk is measured there against the insurer's capacity to absorb, from a solvency standpoint, the financial impact of a cyber loss. This scenario-based approach circumvents the impossibility of calibrating a complete distribution by testing the resilience of the balance sheet to shocks defined a priori, a more modest approach but one better suited to a risk whose distribution tail escapes classical statistical estimation.

Governing what one cannot price

The second pillar completes this apparatus by shifting the burden toward governance. The Own Risk and Solvency Assessment, the ORSA, requires each insurer to conduct a forward-looking analysis of its own risks, in which cyber must now feature through scenarios suited to its profile. In February 2026, EIOPA revised its Guidelines on the supervisory review process to explicitly incorporate IT and cyber risks, calling on national supervisors to make them a core part of their reviews⁶. Where the first pillar struggles to set a figure, the second organizes a qualitative and continuous vigilance, an implicit acknowledgement that cyber is better governed than capitalized.

VI.Toward a Cyber-Native Prudence?

The timeline of the review

The revised directive of 27 November 2024, which amends Solvency II, will enter into application on 30 January 2027, accompanied by a delegated regulation adopted in October 2025⁷. This review strengthens proportionality, integrates requirements relating to climate risk and reinforces macroprudential tools, but it creates no cyber capital module within the standard formula. The regulator's deliberate choice is to advance through transparency and governance rather than through a capital charge whose calibration would, given the current state of data, be largely arbitrary. This caution is consistent with a risk whose distribution cannot yet be estimated. It still leaves a gap between the sophistication of the exposure and the crudeness of its translation into capital.

What a cyber-specific treatment would need

A cyber-native prudential treatment would require clearing several obstacles. It would first need pooled sectoral data, rich and homogeneous enough to calibrate credible accumulation scenarios, something to which S.14.03 reporting is beginning to contribute. It would then need models capable of explicitly representing the tail correlation between underwriting, operations and assets, where the modular formula dissolves it. It would finally need to settle a question of substance, whether a share of cyber accumulation risk, like a share of the climate risk discussed earlier in this series, falls within a capacity that the market alone can bear, or whether it calls for a market-wide mechanism or a public backstop, along the lines of the arrangements envisaged for extreme natural catastrophes.

The general point is simple: a prudential framework can capitalize only what it can measure, and it can measure only what it has a history of. Cyber risk, because it is young, shifting and systemic, lays this limit bare. The European response, transparency, stress tests and governance, is methodological caution: do not put a number on a tail you cannot model, and first gather what you need to measure it. Cyber will eventually enter the standard formula. What remains open is whether the industry and the supervisor will manage to accumulate, quickly and collectively enough, the knowledge that will make this integration something other than an exercise in calibrated arbitrariness.