Estimated reading time: 7 minutes
McKinsey rates cybersecurity as critical for claims frequency and severity in commercial property and casualty lines. Only two other industries earn that rating in the same grid. They are cloud services and semiconductors. For a cyber underwriter, those are not three industries. They are one accumulation event with three names.
The rating appears in “The Strategic New Arenas Reshaping Insurance,” published by McKinsey’s Financial Services Practice this month. The report identifies 18 high-growth industries it calls arenas. The McKinsey Global Institute projects those arenas will generate 29 trillion to 48 trillion dollars in revenue by 2040. Most of the document concerns obesity drugs, electric vehicles and genomics. Roughly three pages concern cyber. Those pages deserve a close read.
Three Arenas, One Cyber Insurance Accumulation Risk
McKinsey sorts its arenas into five themes. Cloud services and semiconductors sit under AI foundation. Cybersecurity sits under digitization. The taxonomy serves economists well. It serves underwriters badly.
A carrier writing a technology book does not hold three separate exposures. It holds one. A hyperscaler outage, a chip fabrication halt, and a widely deployed software vulnerability produce the same claims pattern. Many insureds fail at once. Business interruption drives the loss. Recovery depends on a third party the policyholder does not control.
The report describes each mechanism accurately. On cloud, it says a single outage violates “the independence assumption of standard property underwriting.” On semiconductors, it notes that roughly 90 percent of advanced chips come from facilities in Taiwan. When we come to cyber, it says one vulnerability produces claims “more akin to a natural catastrophe than traditional liability.”
Three descriptions. One risk. The report never joins them.
What The Report Says About Systemic Cyber Risk And Reinsurance
One sentence in the commercial lines section should reach every chief underwriting officer. McKinsey writes that portfolio diversification offers less protection than underwriters assume. It then states that “tail correlations exceed what traditional reinsurance can absorb.”
That is a consulting firm telling carriers their reinsurance program is insufficient. It is published, attributed, and on the record.
The report points to the capital market response. Beazley has issued 670 million dollars in cyber catastrophe bonds. It holds more than 1 billion dollars in cyber excess of loss cover. Those figures match what Beazley chief underwriting officer Paul Bantick described in December 2025, alongside the PoleStar Re 2026-1 placement. McKinsey also cites the accumulation model Beazley, Munich Re and Gallagher Re built jointly.
The Premium Pool Does Not Match The Cyber Accumulation Exposure
McKinsey sizes each arena’s value at stake for insurers in 2040. Cybersecurity receives 60 billion dollars. E-commerce receives 1,160 billion. Electric vehicles receive 200 billion. Cloud services receive 170 billion. Semiconductors receive 140 billion.
So the arena McKinsey rates critical for claims severity carries roughly five percent of the value assigned to e-commerce. It also sits below batteries, space and modular construction.
Cyber underwriters have made this argument for a decade. Exposure grows faster than the premium that funds it. The report states the mismatch without noticing it.
The gap matters more now than it did three years ago. CINI has reported Howden’s finding that the cyber market has fallen 27 percent since 2022. Rate-driven growth has stalled. McKinsey builds its entire premise on that slowdown. Carriers hunting new premium pools will find cyber’s pool small and its tail long.
The report also notes cyber’s arrival as a stand-alone personal lines class. Several insurers now sell personal cover for ransomware, identity theft and cyberbullying. CINI reported Tokio Marine’s view that the personal cyber market has already arrived. That pool is real. It is also small against the commercial tail.
Where The Cyber Accumulation Numbers Come From
The value at stake column deserves scrutiny. A footnote explains the method. McKinsey multiplies each arena’s 2040 midrange revenue estimate by a 6.8 percent risk premium. That premium comes from the RMIS Risk Report 2019.
One constant. Applied to space, obesity drugs and cyber alike.
The calculation sizes an industry. It does not forecast an insurance market. Readers should treat the column as a scaling exercise rather than a premium projection.
The impact grid carries a similar caution. McKinsey describes it as expert judgment combined with institute research. The firm says its rankings indicate “relative importance rather than precise quantitative estimates.” No loss data sits behind the color coding.
That limitation will be familiar to readers of this publication. Vendors and analysts keep publishing exposure maps. Loss experience connecting the map to claims outcomes remains absent.
Take The Cyber Insurance News Survey
Respondents get the results first
Cyber Accumulation In Data Centers Moved Faster Than The Report
McKinsey treats data centers as a property and construction problem. Hyperscale facilities often carry total insured values above 10 billion dollars. Property markets struggle to absorb that concentration.
Its examples have aged. The report cites Marsh’s Nimbus facility and dates the launch to June 2026. Marsh launched Nimbus on 16 June 2025. The facility carried 1 billion euros in all-risks construction. Delay in start-up cover ran to 350 million euros. Marsh then expanded the facility to 2.7 billion dollars in January 2026. The report describes a market position that ended eight months before publication.
The Aon reference holds. Aon expanded its Data Center Lifecycle Insurance Program to 5 billion dollars on 20 July 2026.
The cloud correlation point holds better still, because CINI has already priced it. Parametrix estimated a 5.4 billion dollar loss to US Fortune 500 companies from the CrowdStrike outage. Parametrix also found cloud outages rose 18 percent in 2024. McKinsey says the independence assumption fails. CINI has reported what that failure costs.
What Cyber Insurance Accumulation Risk Means For Underwriters Now
The report closes with questions for chief executives. Two matter here. McKinsey asks whether the dominance of AI across the arenas creates a concentration risk. It asks where carriers need capital they do not hold today.
Cyber underwriters answered both years ago. The value of this report lies elsewhere. It carries the accumulation argument to boards that do not read cyber trade press.
One item deserves watching. McKinsey flags harvest now, decrypt later as “a systemic tail risk that cyber insurers are beginning to model.” CINI covered that exposure in CyberCube’s 2026 predictions. The consulting mainstream has caught up.
Get The Cyber Insurance News Upload
Subscribe to our weekly newsletter!
FAQ – Cyber Insurance Accumulation Risk
What is cyber insurance accumulation risk?
Accumulation risk is the chance that one event triggers claims across many policyholders at once. A cloud outage or a widely deployed software flaw can do this. McKinsey compares the pattern to a natural catastrophe rather than traditional liability.
What did McKinsey say about cyber reinsurance?
The report states that tail correlations exceed what traditional reinsurance can absorb. It also says portfolio diversification offers less protection than underwriters assume. McKinsey points to catastrophe bonds and other capital structures as the response.
How large does McKinsey think the cyber opportunity is?
The report assigns cybersecurity 60 billion dollars of value at stake in 2040. E-commerce receives 1,160 billion. That figure comes from a single risk premium multiplier drawn from a 2019 report, so it sizes an industry rather than forecasting a premium pool.
Why do cloud services and semiconductors matter to cyber underwriters?
Both concentrate global dependency in few providers. Roughly 90 percent of advanced chips come from Taiwan. One cloud outage can interrupt tens of thousands of dependent businesses. Both produce contingent business interruption claims across a cyber book.
Does the report contain loss data?
No. McKinsey describes its impact grid as expert judgment combined with institute research. The firm states that rankings indicate relative importance rather than precise quantitative estimates.
What should underwriters do with the findings?
Treat the report as a board-level document rather than an underwriting input. Its value lies in carrying the accumulation argument to executives outside the cyber market.
Related Cyber Insurance Posts
- A Carrier Built The Thing Vendors Have Been Selling
- Data Center Cyber Claims Rank Second. The Larger Exposure Is Invisible.(Opens in a new browser tab)
- AI Cyber Insurance Coverage Gaps: The Losses Willis Says Your Policy Won’t Pay(Opens in a new browser tab)
- Cyber Risk: Squalify Launches U.S. Platform with Dollar Metrics(Opens in a new browser tab)
- Credential Theft Cyber Insurance: What 2.86 Billion Stolen Credentials Mean For Underwriters(Opens in a new browser tab)