A worst-case scenario stress test for insurers who write cyber policies shows that they would see their capital and surplus reduce by 5 to 8 per cent on average.That would leave them still able to meet their enhanced capital requirements.However, this is based on affirmative cyber policies, where cyber perils are explicitly covered in stand-alone policies or endorsements added to other wider-scope policies.The potential costs from exposure to non-affirmative, or so-called silent cyber, where perils are not explicitly included or excluded from policies is of concern to the Bermuda Monetary Authority.In its Bermuda Cyber Underwriting Report for 2019, the financial-services regulator expressed concern that significant losses could arise from non-affirmative exposures.The BMA said it will continue its enhanced engagement with insurers this year “to ensure appropriate risk management frameworks are in place to also cover non-affirmative cyber exposures”, and added that it may require more disclosures around non-affirmative cyber exposures.It said insurers “may consider” reinsurance programmes to manage non-affirmative exposures.In addition to the impact on insurance policies, the BMA believes insurers should consider incorporating stress testing models that also consider potential losses from a global cyberattack that could impact their own operations, while still being required to pay claims.In 2018, Bermuda’s commercial insurers reported gross written premiums of $2.1 billion for affirmative cyber-risk, which was more than double the $845 million reported in 2017.There was a major jump in gross written premiums by reinsurers in 2018, which the BMA said suggested an increased interest in cyber business by reinsurance companies.In 2018, aggregated losses from affirmative cyber policies for commercial insurers were $239 million, up from $130 million the previous year. The BMA report said: “Claims experienced to date for the cyber line has been low, showing loss ratios of around 26 per cent.”Cyber claims totalling $99 million were paid out for more than 3,800 claims in 2018, compared to $46 million for more than 6,600 claims in 2017.The BMA also reported that many organisations are assessing how best to use captive reinsurance management to cover cyber-risk. The report said: “Bermuda captive insurers have begun to provide solutions for cyber-risk exposure to their parents and affiliates. This has increased both the number of captives writing affirmative cyber policies, as well as the volume of premiums year-on-year”.