Systemic cyber risk and cyber catastrophe bonds

Systemic cyber risk is the chance that a single event, such as a failed software update, a cloud provider outage or a self-spreading wiper attack, causes losses at thousands of companies at the same moment. Insurers cannot diversify that exposure the way they spread fires or lawsuits, so they cap it with sublimits and exclusions in your policy and lay it off to reinsurers and, increasingly, to catastrophe bond investors. As a buyer you will never own a cyber cat bond, but the way insurers manage this risk shows up in your policy wording.

Why cyber risk accumulates

Ordinary insurance works because losses are mostly independent: one warehouse burns, one driver crashes. Cyber losses can be correlated through a shared cause: the same software, the same cloud region, the same managed service provider. An insurer with 5,000 policyholders is not insuring 5,000 independent risks if 2,000 of them use the same accounting platform.

The U.S. Treasury's Federal Insurance Office described the problem in its June 2026 report on the Terrorism Risk Insurance Program. It groups cyber risk into three categories: a cyber attack certified as an act of terrorism, attritional incidents like typical ransomware, and cyber "tail" events that cause catastrophic losses. It cites scenarios in which incidents, malicious or not, spread across the connected world and cause system-wide outages, and it calls the July 2024 CrowdStrike outage and hyperscale cloud outages "near misses."

Events that show the shape of the risk

The lesson is not that these losses were catastrophic for insurers. Most were not. The lesson is that a slightly larger or longer version could be, and nobody knows the probability. Marsh told Treasury that insured losses cover roughly 1% of the economic loss from cyber events; Aon said large systemic events are "increasingly subject to exclusions or tight limitations."

How the market handles it

Policy-level limits. Insurers cap what a single event can cost them through aggregate limits, sublimits on dependent business interruption, waiting periods measured in hours and, in some forms, "widespread event" or infrastructure provisions that treat an event hitting many insureds differently from a single breach. Lloyd's Market Bulletin Y5381 required Lloyd's cyber policies incepting on or after March 31, 2023 to exclude war and state-backed attacks that significantly impair a state's functioning, with a defined attribution process.

Reinsurance. Primary cyber insurers pass a large share of premium to reinsurers. The Geneva Association's December 2024 research summary reported estimates of 40% to 50% of cyber premium ceded to reinsurers, compared with 10% to 15% for more mature lines such as property and liability, and cited a CyberCube estimate that carriers would need $121 billion of capital to cover a 1-in-250-year U.S. cyber loss. See what is reinsurance, and why it affects your business premium.

Capital markets. Cyber catastrophe bonds move peak risk to investors. The mechanics are the same as natural catastrophe bonds (Catastrophe bonds and ILS: how they work and who they affect): investors put up the principal in a collateralized vehicle; if a qualifying cyber event pushes the sponsor's losses past an attachment point, the principal pays the sponsor; if not, investors get it back plus a high interest spread.

The cyber cat bond market so far

• The Geneva Association counted at least five insurers issuing cyber insurance-linked securities from the start of 2023. Early 144A deals were mostly per-occurrence, excess-of-loss indemnity structures, and the Association noted investors wanted exposure to extreme but rare events. It put the total risk transferred by then at around $800 million.
• Beazley closed a $300 million PoleStar Re Ltd. 2026-1 cyber cat bond in December 2025 with three sub-layers, a three-year term ending in 2028, and cover for "remote probability catastrophic and systemic cyber events," according to Beazley. Beazley says it has $670 million of cyber cat bonds outstanding.
• Chubb placed $150 million of East Lane Re VII Series 2026-1 notes, which Artemis described as the first annual aggregate cyber cat bond. They attach at $600 million of aggregate losses, exhaust at $750 million, carry a $25 million franchise deductible and cover calendar years 2026 and 2027. The initial spread was 8.5%.
• Hannover Re's Cumulus Re Series 2026-1 is a $35 million parametric deal triggered by the outage duration of major U.S. cloud provider regions, renewed in March 2026 (Artemis).
• It remains small. The whole catastrophe bond market stood at about $65.5 billion at the end of Q3 2026, per Artemis. And in September 2026, CyberCube said no 144A cyber cat bonds had been issued so far in 2026.

The Geneva Association lists the obstacles: inconsistent definitions of triggering events and exclusions, a narrow investor base and doubts about diversification, since a systemic cyber event could also hit asset prices.

Is there a federal backstop?

Not for cyber specifically. Treasury confirmed in 2016 that the Terrorism Risk Insurance Act applies to cyber coverage written in TRIA-eligible lines, but reimbursement is potentially available only for a cyber attack certified as an act of terrorism (Terrorism insurance and TRIA: how the federal backstop works). In its June 2026 report, Treasury said commenters worried that certification could be uncertain and that protection gaps for non-certified catastrophic cyber incidents could be large, while the NAIC and others said the case for a federal response was premature. TRIA is authorized through December 31, 2027. Both chambers passed reauthorization bills in 2026 that would extend the program to 2034, according to Insurance Journal, but neither was law as of October 10, 2026, and we found no enacted separate cyber backstop.

What it means for your policy

A hypothetical shows the mechanics. Say a carrier insures 2,000 small firms that all depend on one payroll platform, each with a $1 million business interruption limit. If the platform fails for a week, the carrier's theoretical exposure is $2 billion. No carrier holds that. So the policy likely carries a dependent-business-interruption sublimit, a waiting period and perhaps a widespread-event clause, and the carrier's reinsurance treaty has an event cap. Your $1 million headline limit may deliver a fraction of that for this particular loss.

Review these points with your broker:

1. System failure. Does the policy cover a non-malicious outage, like CrowdStrike, or only a security breach? See System failure, cloud outages and the CrowdStrike lesson.
2. Dependent business interruption. Are cloud and software vendors covered by name or unnamed, and at what sublimit and waiting period?
3. Widespread event or infrastructure wording. Look for terms that reduce limits when many insureds are affected.
4. War and state-backed attacks. Read the exclusion for attribution and "significant impairment" language (war and state-backed attack exclusions in cyber policies).
5. Aggregate and per-event limits. Is there one annual aggregate for everything?
6. Vendor concentration. Know which providers could take you offline, and whether you have a manual fallback.

Key takeaways

• Systemic cyber risk is correlated, so insurers manage it with sublimits, waiting periods, exclusions and reinsurance rather than pooling.
• Cyber cat bonds are real but small: Beazley's $300 million deal and Chubb's $150 million annual aggregate deal closed in December 2025, and CyberCube said in September 2026 that no 144A cyber cat bonds had been issued so far that year.
• The federal TRIA backstop reaches cyber only if an attack is certified as terrorism, and it expires at the end of 2027 unless Congress extends it.
• For your own policy, read system failure, dependent business interruption and war exclusion terms before you rely on the headline limit.