Reinsurers Price Cyber Liability on Ransomware Frequency, Not Breach Count
Reinsurers price cyber liability on how often ransomware events hit a book, not on how many breach notifications pile up. Frequency sets expected loss, and expected loss sets the ceded premium. Breach counts are noisy, partly duplicative, and often too small to reach a retention. Ransomware events recur, aggregate, and trigger claims across many insureds at once, which is why they dominate the pricing conversation.
Frequency Drives Cyber Reinsurance Pricing
Breach counts are noisy. A single intrusion can generate notifications to a regulator, a state attorney general, affected customers, and a credit monitoring vendor, and each filing may land in a different tally. Ransomware events are cleaner units. Either a policyholder reported an encryption or exfiltration event in the period or it did not. That binary quality makes frequency modellable in a way that notification volume is not.
Reinsurers model event frequency because one ransomware event can trigger claims under several policies at once. A managed service provider that gets hit may pull in claims from its own cyber policy, its technology errors and omissions cover, and the cyber policies of clients whose data sat on its systems. Severity then determines how deep into the tail those claims run, but frequency determines how often the reinsurer is asked to respond at all.
The split matters for pricing. Expected loss is roughly frequency multiplied by average severity. Reinsurers can argue about severity for years, since ransom demands, business interruption periods, and legal costs all move. Frequency is observable sooner, and it is the input that shifts ceded premium fastest when a sector starts getting hit repeatedly.
The Data Reinsurers Actually Use
Claims frequency per policy year is the core input. Reinsurers want event counts by industry, by revenue band, and by security control maturity, not headline totals. A retail book with two hundred small breach notifications but three ransomware events prices differently from a book with forty notifications and eleven ransomware events, even if the notification totals look similar on a slide.
Incident response vendors supply much of the raw event data. These firms are called in when an encryption event is live, so their case counts approximate actual event frequency better than public breach portals do. The catch is coverage. Not every insured calls the same vendor, and reporting thresholds vary, so reinsurers triangulate across several vendors and adjust for known gaps.
Industry loss warranties tied to event frequency also feed the model. A warranty that pays when aggregate sector losses exceed a threshold gives reinsurers a market-level frequency signal they can compare against their own book. Ceded premium relative to the frequency trend is the final check. If ceded premium is falling while event frequency is climbing, something in the structure or the reporting is off.
Data quality varies widely. Reinsurers often find that incident response vendors tag events differently, with some counting only confirmed encryption and others including attempted intrusions that were blocked. That inconsistency means a reinsurer may adjust vendor counts by 10–20% to align definitions before blending them into a single frequency estimate.
Why Breach Counts Mislead Pricing Models
Small breaches rarely breach retention. A misplaced laptop or a misconfigured cloud bucket may generate a notification and a modest forensics bill, but the loss often stays inside the insured's self-insured retention. Those events inflate breach counts without generating recoveries, so a model trained on notification volume overstates how often the reinsurance layer actually responds.
Ransomware generates immediate, aggregate claims. Encryption halts operations, so business interruption clocks start on day one. Exfiltration adds notification costs, credit monitoring, and legal exposure on top. A single event can produce a claim that clears the retention in a week, which is a different claims pattern from the slow drip of small breach notifications.
Frequency clustering is the real concern. Insureds in the same sector often run similar software stacks, so one exploited vulnerability can produce events across many policyholders in a short window. Reinsurers weight event recurrence over notification volume because recurrence is what creates the correlated losses that pierce treaty layers. A related piece on this site, Cyber Liability Recoveries Against What Carriers Book as Premium, looks at how those recoveries sit against booked premium.
Ransomware Frequency and Reinsurance Recoveries
Treaty structures respond to frequency, not to each individual breach. A per-occurrence excess of loss treaty attaches above a retention for each event, so the number of events in a year determines how many times the reinsurer pays. An aggregate deductible, by contrast, is exhausted by the sum of events, which makes event count the controlling variable rather than any single loss size.
Recoveries depend on the event definition in the contract. If the treaty defines an event as a single intrusion or a single threat actor's campaign, ten insureds hit by the same ransomware variant may count as one event or as ten. That definitional choice can swing recoveries by an order of magnitude, and it is negotiated harder than the rate on line in many renewals.
Frequency shifts move ceded premium faster than severity does. When event counts rise, reinsurers reprice the expected number of attachments, and the ceded premium follows within a renewal cycle. Severity moves tend to be absorbed by retentions and coinsurance first. For a pricing team, the frequency trend is the earlier and more actionable signal.
What Moves Cyber Premiums Now
Ransomware event frequency in key sectors is the dominant input. Manufacturing, healthcare, and managed services have shown repeated event clustering, and reinsurers watch those sectors for correlated exposure. A sector that produces several events in a quarter will see its ceded premium and its retention terms adjust at the next renewal, sometimes sharply.
Reinsurer appetite for frequency-driven treaties has tightened. Capacity is available, but it is often structured with aggregate caps, event definitions that favor the reinsurer, and reinstatement terms that price the second and third event higher than the first. Buyers who want broad frequency cover pay for it in the structure rather than the headline rate.
Incident response data quality remains a real constraint. Reporting lags mean a reinsurer may price a renewal on event data that is a quarter or two stale, and inconsistent event tagging across vendors makes aggregation unreliable. Event definition disputes in reinsurance contracts are the predictable result. A related piece on this site, NAIC Complaint Ratios Show Where Professional Liability Expectations Break Down, makes a similar point about expectations diverging from booked experience.
The counterargument deserves a hearing. Some underwriters argue that frequency data is too thin and too vendor-dependent to anchor a pricing model, and that severity assumptions carry more weight than the frequency signal suggests. That view has merit where a book is small or concentrated in one sector. It fails when a book spans many insureds running common software, because that is exactly where frequency clustering produces the correlated losses that severity models alone miss.
Practical Steps for Pricing Review
Track ransomware event frequency per policy year, not breach notification counts, and keep the two series separate in the pricing file so a notification spike does not read as a frequency spike.
Align internal event definitions with the reinsurance treaty language before renewal, because a mismatch between how the cedent counts events and how the treaty counts them creates recoveries that cannot be collected.
Stress-test aggregate deductibles against a frequency spike scenario, such as several insureds in one sector hit within a quarter, and check whether the layer still responds or is exhausted before the losses land.
Demand incident response data with consistent event tagging across vendors, including a clear field for whether encryption, exfiltration, or both occurred, so frequency counts are comparable year over year.
Review ceded premium against the frequency trend every quarter, not just at renewal, because a widening gap between the two is the earliest sign that the treaty structure or the reporting is mispricing the risk.
This article is informational and not personalised professional advice. Pricing decisions depend on the specific book, treaty terms, and data available to each carrier.
