Demystifying Adverse Selection in Cyber Insurance

Adverse Selection is a term used in insurance to explain why a portfolio behaves worse than what was intended. It is used to support pricing action where there’s no clear actuarial evidence, or to oppose a certain portfolio action that might have a counterintuitive detrimental effect on profitability. This is exacerbated in cyber insurance, being a new and dynamic line of coverage where the industry has limited experience of profitably pricing the risk.

This memo aims to demystify Adverse Selection by offering a clear definition of what it is and what it is not, the mechanism by which it happens to cyber insurance portfolios, how to discover it, and what can be done about it.

What is adverse selection?

Adverse selection is a theoretical model in economics that was introduced by Akerlof in the 1970s in his Noble winning work “The Market for Lemons”. This model explains how information asymmetry can lead to market failure. Specifically, the model explains why when one party in a transaction has more information than the other, it leads to a less favorable outcome for the less informed party.

In this memo we define Adverse Selection as the impact of actions of competitors in the market on deterioration in profitability in an insurance portfolio. With this concrete definition, we aim to make Adverse Selection directly measurable, and separate it from changes in the actual risk underlying a portfolio.

How is it caused?

Adverse Selection is caused by competitors, through their actions, attracting better risks for their own books, while pushing away the worst performing risks to others. This is best illustrated with a simplified example:

Assumptions

• The market has 100 insureds:
  • 50 High hazard insureds with an expected loss of 100
  • 50 Low hazard insureds with an expected loss of 50
• The market has two competitors – Insurer A and Insurer B
  • Pricing for 20% expense load, profit load of 10%
  • Fixed costs of 500

Scenario A: No adverse selection

In this scenario the insurers don’t know how to differentiate between high and low hazard insureds, so they price to the market average expected loss.

Hence the market price would be:

P = (Exp Loss + Fixed Expense) / (1- Variable Expense – Profit) = (75 + 500/50) / (1- 0.2 – 0.1) = 121.4

In this scenario the insurers split the market, and achieve similar profitability.

Scenario B: Adverse selection for Insurer B

In this scenario Insurer A has developed the ability to differentiate between high and low hazard insureds, while insurer B didn’t. Insurer B continues to price each policy as previously at 99, while insurer A now has a two tier pricing plan:

• For High Hazard insureds the price is (100 + 500/50) / (1- 0.2 – 0.1) = 157
• For Low Hazard insureds the price is (50 + 500/50) / (1- 0.2 – 0.1) = 85

This more advanced pricing would cause Insurer A to undercut Insurer B for the low hazard accounts, while losing the high hazard accounts to insurer B who remains competitive. Now lets look at the financial results:

In this scenario Insurer A has a smaller premium base, because its average price is lower, but improves profitability. Insurer B is loss making. Note that if Insurer A knows that Insurer B can’t differentiate risks, it can price the low hazard accounts much closer to 121, to capture more profits. In case the pricing is 121, the profits would be 2,060, much higher than in scenario A.

Importantly, adverse selection is not a situation where there is an increase in overall market expected loss. Such change in expected losses becomes adverse selection when at least one insurer in the market responds and captures this data in their underwriting and pricing. The Cyber Insurance Market is unique in that there are often changes in attacker tactics that cause the underlying risk to evolve, once a competitor responds to them they essentially push the rest of the market into adverse selection territory.

Why is it happening?

The theoretical driver of this is data asymmetry – i.e. one insurer knows more about the risk than its competitors, being able to attract better risks while churning the worst risk in the portfolio. Practically speaking, there are other drivers that might cause adverse selection:

• Technical discovery capabilities – Insurers in the cyber market diverge in their technical abilities to discover drivers of risk. Some players can collect technical data and adjust their decision making based on this data, while others rely on questionnaire and third party scoring models. The latter have less of a capability to discover a new issue, and hence have a higher chance of being adversely selected
• Timeliness – taking decisions requires credible information. This means that all else being equal insurers with scale could react faster than smaller players, creating a time gap in which the smaller players are adversely selected
• Lack of action – if an insurer knows where the worst performance segments are, but is not taking action it can still be adversely affected. For example, by trying to maintain renewals of worst performing risks
• Distribution / channel advantage – channels can be adversely affected as well (e.g. wholesale vs. retail, or admitted vs. E&S, SMB vs. Enterprise). In this case, an insurer might be blocked from attracting the better risks even if it can identify them because of their distribution capabilities in the different segments

How to discover and manage adverse selection?

Discovering adverse selection in a portfolio has two flavors based on the information an insurer has: known variables, and unknown variables. A robust program of tackling adverse selection would tackle both, an exceptional program would force adverse selection on competition, while constantly looking to improve the portfolio profitability.

Known Variables

The adverse selection in this case is happening because competitor(s) have worsened or softened terms in a segment that is already tracked. This would manifest itself in a steadily increasing/decreasing bind ratio for that segment that is not driven by action an insurer has taken itself. In term, this could cause an increase in an unwanted segment, or a decrease in an attractive segment, leading to worse loss performance.

How to discover it?
Discovering “known variables adverse selection” involves tracking sub segments on a portfolio basis looking for anomalies. An out of band high bind ratio would indicate that a segment is potentially being impacted. Another approach is to track the competitors from whom you’re winning accounts, and look for anomalies over time which can indicate the competitor changed their underwriting strategy.

It’s important to note that in cases where not all competitors identify a segment as adverse there might be a situation that there’s enough competition in a worse segment. In that case, it will be near impossible to realize one is adversely selected because the addition of bad risks will be minimal (if for example 1 of 50 carriers stops writing a segment).

What to do about it?
Once identified and validated, the best course of action is fast response to the segment in question. Ideally this response would have minimal disruption to growth, which is achieved by identifying as narrow segment as possible

Unknown variables

The adverse selection in this case is happening because competitor(s) have found an unknown variable that has a strong predictive power. The competitor(s) has worsened terms for insureds that present this variable. If done at scale, this could manifest in an overall increased loss experience across the book without a clear explanation that is well captured on existing variables. For example, some industry participants started pricing for insureds with certain on-premise VPNs in 2023, before many others in the market started to price for this topic. This created a separation of loss results, driving worse results for carriers that didn’t price for this issue. The laggers were adversely selected.

How to discover it?

It’s daunting to discover this type of adverse selection because the driver, the new variable, is not part of the risk and segmentation model. These types of drivers can be gleaned from analyzing claims, reading market reports and following other external sources. The main issue is that there’s usually a significant time lag between this issue starting to happen and until it is visible in claims and market reports.

Hence, the best approach to avoid unknown variable adverse selection is to continue to invest in research of new variables that are correlated with loss performance. This is doubly important in cyber insurance where drivers of loss like attacker tactics and exploited technologies evolve regularly.

What to do about it?

The first step of dealing with unknown variable adverse selection is to identify the variable, and introduce it to the risk model. Once that happens, it becomes a known variable and can be monitored and managed through underwriting and pricing.

Conclusion

Adverse selection is a well defined, measurable phenomenon, not an abstract concept threatening cyber insurance books. Managing adverse selection entails monitoring book performance for anomalies, staying on the cutting edge of incident and loss drivers, and taking swift action.

Crucially, and by definition, any given book of insurance will always have adverse selection happening at any point in time. So the question is not whether a book is being adversely selected against, the question is where, and at what scale.

In cyber, managing adverse selection should be viewed in tandem with continuing to expand the understanding of risk to tackle new drivers of loss, and investing in risk mitigation.