Cyber catastrophe bond
A security that passes systemic cyber risk to the capital markets. Structuring one runs into two gaps: there is no stationary model, and no uncorrelatedness.
In January 2023 Beazley placed Cairney Cyber, a $45m private catastrophe bond protecting its own book against a systemic cyber event; the first 144A cyber issuances followed in early 2024. The mechanics are those of any cat bond. A dedicated vehicle issues notes, holds the proceeds as collateral in a segregated account, pays a coupon funded by the cedent's premium, and gives up principal only if the trigger is hit. The transfer is fully collateralized, which takes the counterparty risk of an ordinary treaty close to nil. Cyber lacks two things natural perils have. There is no stationary physical model: the technical environment rewrites itself within a few years, and the quoted attachment probability comes from vendor models that diverge widely. And uncorrelation with financial markets, the whole point of the asset class for an ILS investor, is not a given, since a systemic cyber catastrophe can hit market infrastructure itself. The market exists, but stays narrow, held by a handful of sponsors and by indemnity triggers.
The largest issuance to date, $300m in December 2025, rests on an indemnity trigger on a per-occurrence basis, applied to a peril with no natural occurrence.
cyber cat bond, cyber catastrophe bond
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.