Cyber Liability Recoveries Against What Carriers Book as Premium
Cyber insurance premium gets booked when the policy incepts. Recoveries from reinsurers arrive later, in smaller amounts than the ceded loss estimates suggest, and sometimes not at all. The gap between the two is the subject here, and it is wider than most balance sheets admit.
The Gap Between Booked Premium and Recoveries
Gross written premium for cyber has climbed steadily for years. Net premium, after ceding to reinsurers, tells a different story. Carriers book the gross figure on day one, then carry a reinsurance recoverable as an asset against expected losses. That asset is an estimate. It depends on the reinsurer agreeing the loss falls inside the contract.
Moody's Ratings surveyed reinsurance buyers for 2027 and found demand for cyber reinsurance projected to be stable, with almost half of respondents expecting low to mid-single-digit price declines. Healthy demand, softer pricing. That combination matters because softer ceded pricing improves the primary carrier's economics only if recoveries actually materialise.
Reinsurance recoveries function as a profit lever. When a carrier cedes 40% of a book and the reinsurer pays promptly, the carrier's net loss ratio looks better than the gross. When the reinsurer challenges notice timing or loss definition, the recoverable sits on the balance sheet and the leverage reverses. The related question of who ultimately pays a claim runs through this site's comparison of workers compensation and commercial auto, and the same logic applies to cyber.
The accounting itself compounds the problem. Under statutory accounting, a recoverable is admitted only to the extent it is collectible, and the carrier must reserve for the possibility of dispute. In practice, the reserve is an actuarial judgment. Two actuaries looking at the same ceded loss triangle can land on recoverable estimates that differ by 10–20%, which is a wide band when the recoverable is a meaningful share of surplus. That band is where the earnings volatility hides.
How Cyber Reinsurance Recoveries Are Structured
Two structures dominate. Quota share cedes a fixed percentage of every policy's premium and loss. Excess of loss cedes losses above an attachment point, with the reinsurer paying a layer up to a limit. Quota share produces smoother recoveries. Excess of loss produces lumpier ones and far more disputes about whether a loss breached the attachment.
Ceded premium flows to the reinsurer upfront, usually quarterly. Recoveries flow back after the primary carrier has paid the underlying claim and documented it to the reinsurer's satisfaction. That documentation requirement is where timing gaps open. A cyber claim may take months to quantify because forensic costs, notification expenses, and business interruption estimates arrive in stages.
Lloyd's syndicates remain a key source of cyber capacity. Lloyd's operates as a marketplace of syndicates rather than a single company, so a primary carrier may be recovering from several syndicates at once, each with its own claims philosophy and its own view of late notice. That fragmentation slows recovery even when the underlying claim is clean.
The choice between quota share and excess of loss is not purely technical. Quota share gives away a slice of the best business along with the worst, but it stabilises recoveries and reduces the dispute surface. Excess of loss keeps more of the profitable premium but concentrates the recoverable into fewer, larger events where a single disagreement can move a quarter's earnings. For a growing cyber book, the trade-off is between certainty and retained margin, and the right answer shifts with the carrier's capital position and the volatility of its underlying loss picks.
Documented Abuses in Recovery Accounting
Regulatory filings periodically show disputed recoverables. A carrier books an expected recovery, the reinsurer disagrees, and the difference sits in the financial statements as a dispute rather than a write-off. The pattern repeats across lines, not just cyber, and professional liability filings show similar stress where expectations break down, as this site noted on NAIC complaint ratios.
Carriers have an incentive to overstate ceded loss estimates. A larger ceded loss means a larger recoverable, which offsets the gross loss on the income statement. Reinsurers push back hard on this, and their pushback is the check on the practice. Late notice is the most common ground: the reinsurer argues it was not told about a claim within the contractually required window.
Court records reveal commutation disputes as well. A commutation ends the reinsurance relationship early, with the reinsurer paying a negotiated lump sum to be released from future obligations. When a carrier and reinsurer cannot agree on what the outstanding recoverables are worth, commutation talks collapse into litigation. Those filings are public, and they show the size of the disagreement.
The pattern of disputes tends to cluster. When the reinsurance market hardens after a run of losses, reinsurers tighten their claims review and late-notice challenges rise. When the market softens, as the Moody's survey suggests for 2027, reinsurers compete for ceded business and may be more accommodating on the margin. That cyclicality means recoverable quality is not a constant. A carrier that books recoveries at face value through the soft part of the cycle may find the same recoveries challenged when the cycle turns.
The Corgi Effect on Cyber Capacity
Corgi, a San Francisco insurance technology company founded in 2024 and approved as an admitted carrier in 2025, reached a $2.6 billion valuation as of June 2026 following a Series B1 round. Its product line includes directors and officers liability, cyber insurance, commercial general liability, and AI liability coverage. New admitted capacity of that scale changes the ceded flow picture.
AI liability coverage expands the exposure base. Claims arising from model outputs, training data disputes, and automated decisioning do not map cleanly onto traditional cyber triggers. A reinsurer that wrote a cyber excess of loss layer in 2024 may find itself arguing about whether an AI liability claim falls inside the cyber definition at all.
Reinsurance demand grows with new entrants because new carriers typically lack the capital to retain large cyber limits. They cede more, at least initially. Recoveries then face novel claim types that neither the primary policy language nor the reinsurance treaty anticipated, which is exactly the condition that produces disputes.
The capacity story cuts both ways. New entrants like Corgi add supply of ceded business, which gives reinsurers more to choose from and can push ceded pricing down. But the same new entrants are writing novel coverages with limited loss history, so the reinsurer's uncertainty about the underlying exposure is higher. The result is a market where pricing may soften even as the dispute risk on any given recoverable rises. Analysts who track only the price of ceded cover will miss that shift in recoverable quality.
What the Money Trail Reveals
Premium gets booked upfront and recoveries arrive late. That timing mismatch is the core of the accounting risk. A carrier reporting strong premium growth while carrying a growing reinsurance recoverable asset is reporting a claim on a counterparty, not cash.
Reinsurance asset quality is scrutinised for good reason. If a recoverable is large relative to the reinsurer's capital, or if the reinsurer is disputing the underlying losses, the asset deserves a haircut. Rating agency KBRA has argued that discipline determines the credit outcome of soft reinsurance market pricing, meaning carriers that use cheap reinsurance to accelerate growth may see less credit benefit when losses arrive.
Markel named Nick Rugg as Head of Financial Institutions & Fintech for professional and financial risk and cyber in its London specialty operation, effective immediately. Personnel moves like this signal where carriers expect the next cycle of claims and recoveries to concentrate.
For an actuary, the practical read is that cyber recoverables deserve the same scrutiny as any long-tailed reserve. The loss picks are uncertain, the contract language is evolving, and the counterparties are themselves managing volatile books. The gap between booked premium and collected recoveries is not a rounding error. It is a live estimate that moves with the cycle.
Practical Steps for Analysts and Underwriters
Stress-test recovery assumptions by modelling a scenario where the largest reinsurer disputes notice on the largest claim. If the recoverable is material to the balance sheet, quantify what happens when it is written down 50%.
Review ceded reinsurance contracts for cyber-specific definitions. Look for whether AI liability, business email compromise, and ransomware are inside or outside the cyber treaty, and check the notice windows. A 30-day notice requirement against a claim that takes 90 days to quantify is a dispute waiting to happen.
Track regulatory filings for disputed recoverables. Schedule F disclosures and statutory annual statements show the recoverable by reinsurer, and comparing that against the reinsurer's own capital position reveals concentration.
Use the Moody's survey data on cyber reinsurance demand and pricing expectations to frame renewal assumptions, and monitor new carrier capacity entering the market. Corgi's expansion and similar entrants change the supply of ceded business, which changes the pricing leverage between primary carriers and reinsurers.
Build a simple recoverable-quality scorecard: the share of the recoverable concentrated in the top three reinsurers, the average age of outstanding recoverables, and the proportion currently in dispute. Those three numbers, tracked over time, will flag deterioration before it shows up in a reserve charge. The scorecard is not a forecast. It is a way to see the gap between booked premium and collected recoveries widening in time to do something about it.
This article is informational and does not constitute personalised financial, legal, or investment advice.
