Cyber Insurance Reinsurance, ILS and Capacity
In December 2025, Beazley finalized PoleStar Re 2026-1, a ~$300M cyber catastrophe bond and the largest single cyber cat bond issued to date, lifting the deal from an initial ~$280M target on strong investor demand. A $300M capital-markets instrument transferring pure cyber tail risk to bond investors, clearing oversubscribed, indicates that the capacity layer beneath cyber insurance — reinsurance and insurance-linked securities (ILS) — is maturing quickly. The sections below cover who sits behind the carriers, why cyber needs an unusually deep capacity stack, and how the alternative-capital market is being built to absorb a peril that is correlated, fast-moving, and potentially systemic.
Why cyber needs a deep capacity layer
A carrier that writes cyber insurance does not keep all the risk. It cedes a large share to reinsurers — Munich Re, Swiss Re, Hannover Re, SCOR, and the Lloyd's market — who pool it across the industry and across geographies. Cyber is disproportionately reinsured (a much higher cession rate than mature lines like auto) for one structural reason: its losses are correlated. A single ransomware strain, a single cloud-provider outage, or a single widely-deployed software flaw can trigger thousands of claims simultaneously — the aggregation problem detailed on 24e. No single carrier's balance sheet can safely hold that tail, so the risk is pushed up the stack to reinsurers, and from reinsurers — increasingly — out to the capital markets via ILS. The capacity layer is therefore not a back-office detail; it is the binding constraint on how much cyber insurance the world can write. When reinsurers pull back, primary capacity shrinks and rates spike (the 2021–22 hard market); when reinsurers and ILS investors lean in, capacity floods and rates soften (2024–25). The capacity cycle is the cyber-insurance cycle.
The reinsurers and how they make money
Reinsurers earn by pooling and pricing correlated risk better than any single carrier can, taking a premium to hold the tail. In cyber they play two roles: a capacity role (providing the balance sheet that lets primary carriers grow) and, per S&P, an increasingly advisory role — acting as active partners who help primary insurers navigate a fast-moving peril, sharing models, claims data, and wording discipline. The big four (Munich Re, Swiss Re, Hannover Re, SCOR) anchor the market; Munich Re in particular is both a major cyber reinsurer and a participant in the managing-general-agent (MGA) layer (see 24a) — a vertical position that lets it see and price the risk from origination to tail. That position moved from investment to ownership on Aug 19 2026, when Munich Re agreed to acquire At-Bay outright at a $575M enterprise value, placing it under HSB with closing expected in Q1 2027 (11). Swiss Re's cyber unit estimated global gross written premium at ~$16.6B in 2025, growing ~20% annually, yet still less than 1% of global P&C premium — the headroom the bull case rests on, and the systemic exposure the bear case fears.
ILS: putting cyber tail risk into the capital markets
Reinsurers themselves need to offload tail risk, and the deepest pool of capital is the capital markets. Insurance-linked securities — principally catastrophe bonds — let a sponsor transfer a defined slice of extreme loss to institutional bond investors (pension funds, ILS funds, hedge funds) who earn a coupon for bearing it and lose principal if a defined trigger is breached. Cyber ILS is young but accelerating:
- Annual cyber ILS issuance grew from ~$415M (2023) to a projected ~$1.5B+ (2026), with roughly ~$800–900M of cyber cat bonds outstanding and at least five repeat sponsors.
- Beazley pioneered the public cyber cat bond and remains the largest sponsor; its PoleStar Re 2026-1 (~$300M, finalized Dec 2025) is the largest single cyber cat bond to date.
- 2025's public issuance was renewal-led — Hannover Re, Beazley, and Chubb renewed existing programs, with no brand-new sponsor entering, and earlier sponsors (Axis Capital, Swiss Re) looked unlikely to renew expiring exposure — a sign the market is consolidating around committed sponsors rather than broadening.
- Parametric structures are emerging for specific perils — Hannover Re renewed a cloud-outage cat bond (Cumulus Re Series 2026-1, ~$35M of retrocessional protection) that pays on a defined cloud-downtime trigger rather than on indemnified loss — a template for transferring the cloud single-point-of-failure risk that the CrowdStrike event made vivid.
S&P's read is that cyber ILS remains an effective alternative-capital solution for large-scale, systemic risk, and that the cyber reinsurance market is in the early stages of maturing — meaning the capacity stack is being built out in real time, deal by deal.
The capacity stack, layer by layer
| Layer | Who | Function | How they're paid | M&A relevance |
|---|---|---|---|---|
| Primary carrier | Beazley, Chubb, AIG, Axis, Coalition (on carrier paper) | Writes the policy, holds the first layer | Underwriting spread | See 24a |
| Reinsurer | Munich Re, Swiss Re, Hannover Re, SCOR, Lloyd's syndicates | Pools & prices correlated risk; advisory partner | Reinsurance premium | Vertical plays (Munich Re–At-Bay, acquired outright Aug 2026); model/data scale |
| Retrocession | Other reinsurers / ILS | Reinsurance for reinsurers — offloads the tail | Retro premium | Where parametric cloud-outage bonds sit |
| ILS / cat bonds | Beazley (PoleStar Re), Hannover Re (Cumulus Re), Chubb; ILS funds & pensions as buyers | Transfers extreme tail to capital markets | Coupon (lose principal on trigger) | Cyber-risk modeling vendors enable it (24e) |
Why this matters for the deal market
The capacity layer rarely produces flashy M&A on its own, but it governs the economics of everything above it and it creates two adjacent deal lanes. First, cyber-risk modeling and analytics is the enabling technology for the entire capacity stack — reinsurers and ILS investors cannot price a correlated peril without accumulation models, and the vendors that build them (CyberCube, Kovrr, and Guidewire's Cyence; see 24e) are strategic infrastructure with software economics, sitting at the intersection of insurtech and security analytics. Second, vertical integration across the stack is a recurring strategic move: a reinsurer that owns an MGA (Munich Re–At-Bay, agreed August 2026 at a $575M enterprise value after nine years as its backer) captures the risk from origination through tail and owns the data at every layer — the same logic that drove Allianz to rent Coalition's underwriting brain, and the distinction between renting the capability and buying it is now priced. The capacity cycle is also the single most important exogenous driver of cyber-insurance valuations: when ILS capital is abundant and reinsurance soft, primary capacity expands, rates fall, and MGA/carrier growth looks structural; when a systemic event impairs the tail, capacity withdraws and the whole sector re-rates.
Sources — ILS scale & sponsors: Artemis — cyber cat bond news; Artemis — Beazley PoleStar Re 2026-1 lifted to ~$280M target (finalized ~$300M Dec 2025); Insurance Business — Beazley adds $300M cyber cat bond; Artemis — cyber ILS effective for systemic risk (S&P); market sizing: American Academy of Actuaries — Overview of the Global Cyber (Re)Insurance Market (Aug 2025); Hannover Re cloud-outage parametric (Cumulus Re 2026-1) per Artemis cyber cat-bond coverage. Issuance figures are approximate; 2024/2025 annual totals interpolated within the reported 2023→2026 trend (estimates). PoleStar Re 2026-1 finalized Dec 2025.
Updated 2026-10-04 19:34 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.