As both brokers and buyers know well, insurance historically has cycles of hard markets, soft markets, and conditions in between. One line of insurance, however, should behave differently: cyber. Cyberinsurance is unlike standard property and liability lines because the nature of cyber risk is different.

Traditionally, insurance underwriters react to loss events. Something happens that causes an adverse outcome, so underwriters respond by raising rates, tightening terms and conditions, increasing deductibles and retentions, and—if losses are worrisome enough—even reducing capacity. Property insurance often sees rates, terms, and conditions change based on singular events like a massive hurricane that strikes a densely populated area or a wildfire that destroys thousands of structures. Casualty insurance markets tend to contract following periods of high loss frequency and/or severity. Liability exposure is also driven, in part, by events—litigation following an act or omission, nuclear verdicts, adverse court rulings, and so on.

But terms such as "hard market" and "soft market" shouldn't really apply to cyber because the cybersecurity risk is constant. Sure, there are notable large losses from individual cyberattacks, but generally cyberinsurance market conditions should be more risk-driven than event-driven.