Financial Protection Against Catastrophic Risks

3. Examining the need for government-supported financial protection for natural hazard, cyber and infectious disease risks

Abstract

Natural hazards, infectious disease outbreaks and cyber attacks and incidents have the potential to lead to widespread and severe financial impacts. In many countries, private insurance markets have been unable to achieve broad coverage for all potential financial exposures to these risks leaving individuals, households and businesses exposed to potentially significant unprotected financial losses. This chapter applies the framework presented in Chapter 2 to these three risks of potential concern by examining the potential impacts, the adequacy of financial protection provided by insurance markets and the potential implications of unprotected financial exposures for economic activity. It also discusses factors that should be considered in determining the appropriate form of any government-supported financial protection, including the nature of the unprotected financial exposures and the potential for (re)insurance markets to contribute to loss absorption and risk reduction.

3.1. Introduction

Natural hazards, infectious disease outbreaks and cyber attacks and incidents have the potential to result in significant unprotected financial exposures. These three types of risks are relevant for most, if not all, countries and have the potential for widespread and severe financial impacts. In addition, broad protection for all potential financial exposures to these risks has not been achieved through private insurance markets.

The purpose of this chapter is to provide an application of the framework outlined in Chapter 2 to these risks. It first evaluates the need for government-supported financial protection. It provides data on the potential impact of natural hazards, infectious disease outbreaks and cyber attacks and incidents on individuals, households and businesses, and on the possibility that these risks could have significant impacts on a large share of the population. It then assesses the adequacy of financial protection available through private insurance markets and existing social insurance arrangements, and limitations in the availability, affordability and take-up of insurance coverage for these risks. It then examines factors that should be considered in determining the need for government-supported financial protection, including factors related to the potential likelihood, frequency and severity of natural hazards, infectious disease outbreaks and cyber attacks and incidents, the impact of unprotected financial exposures on economic activity and vulnerable populations with more limited capacity to absorb financial losses, as well as the potential to expand the availability, affordability and take-up of financial protection.

The second part focuses on determining the appropriate form of government-supported financial protection, whether as a public-private insurance programme or a public compensation and financial assistance arrangement. It discusses how the nature and implications of exposure to natural hazard, infectious disease outbreak and cyber risks could impact the choice between these two potential approaches to offering government-supported financial protection and on the potential costs and benefits of (re)insurance market participation in assuming risk, supporting quicker payments and reduced fraud, and contributing to risk management and risk reduction, given the different characteristics of natural hazard, infectious disease outbreak and cyber risks.

3.2. Evaluating the need for government-provided financial protection

3.2.1. Identifying risks of potential concern

Governments should identify the “risks of potential concern” that have a non-trivial likelihood of occurring and that could result in high-impacts on a large number of individuals, households or businesses. Natural hazards, infectious disease outbreaks and cyber attacks and incidents are “risks of potential concern” (Table 3.1).1

Table 3.1. Likelihood, impact severity and extent of natural hazard, infectious disease outbreak and cyber risks

	Likelihood of occurring	Potential for high impacts on individuals, households and businesses	Potential for impacts on a significant share of the population
Natural hazards	High likelihood for many natural hazard risks (relatively frequent occurrence)	High impact (damage equivalent to significant share of income)	Potential to impact a significant number of households and businesses
Infectious disease outbreaks	Likely to occur (although low frequency, particularly outbreaks that lead to restrictions on economic activity)	Moderate impact (losses in income and revenue from restrictions on economic activity)	Potential to impact entire population with income and revenue losses concentrated in some sectors
Cyber incidents and attacks	Idiosyncratic incidents are highly likely (high frequency) Cyber catastrophes are likely to occur (although low frequency)	Moderate to high impact (losses in income and revenue from restrictions on economic activity)	Cyber catastrophe could impact a significant number of businesses

All of these risks have a non-trivial likelihood of occurring.

• Risks related to natural hazards: Natural hazards, including floods, storms, earthquakes and wildfires, can result in morbidity and mortality, significant damage to homes and businesses and large income and revenue losses for impacted individuals and businesses. Most countries face damages and losses from natural hazards with some frequency. Natural hazards that impact a large geographical area or important population centres can result in damages and losses for a significant share of the population.

• Risks related to infectious disease outbreaks: Infectious disease outbreaks lead to morbidity and mortality, including an increase in health costs. Outbreaks that require the implementation of government restrictions on economic and social activity can lead to substantial losses in income and revenue. Infectious disease outbreaks occur with some frequency, although outbreaks that result in government restrictions on economic and social activity have occurred rarely. However, when restrictions are imposed, a large share, if not the entire population, are likely to be impacted and face significant income and revenue losses.

• Risks related to cyber attacks and incidents: Cyber attacks and incidents can lead to income and revenue losses and other financial losses from theft of funds, restoration expenses, as well as compensation to third parties and fines and penalties for breaches of legal or contractual obligations (e.g. disclosure of personal data). In some cases, a cyber attack could also lead to damages to property or equipment and bodily injury. While cyber attacks occur with a high-level of frequency and can impact any individual, household or businesses with a connection to the internet, most attacks and incidents are idiosyncratic and result in limited financial impacts. However, there is a clear potential for large-scale attacks that could materially impact a significant segment of the population simultaneously.

All of these risks could be high impact, with the potential to lead to significant financial impacts on individuals, households and/or businesses.

• Natural hazards: Wildfires, cyclones, earthquakes, floods and other natural hazards can lead to deaths and injuries, significant damages to homes and businesses and substantial losses in income and revenue as homes and businesses are repaired or rebuilt. For example, the average National Flood Insurance Program insurance claim for floods in the United States is USD 68 000 (National Flood Insurance Program, n.d.[1]) while the average wildfire claim paid by one insurance company was USD 224 000 in 2021-2022 (Harris, 2022[2]), equivalent to approximately 84% and 278% of median household income, respectively, in 2023. The damages and losses from natural hazards can lead to significant financial stress. One study of the impact of natural hazards on individual financial health in the United States found an increase in debt distress and bankruptcies and a reduction in credit scores among those impacted which continued for a number of years after the occurrence of the event (Ratcliffe et al., 2019[3]). Businesses can face significant disruption to their operations. For example, a study of small businesses affected by flooding in Townsville (Australia) in 2019 found that 56% of small businesses faced business interruption of one month or more, including 28% that faced interruptions or expected interruptions of more than six months (SGS Economics and Planning, 2021[4]). According to one estimate from the United States, more than 40% of businesses do not re-open at all after being impacted by a natural hazard while, among businesses that reopened, only 29% were still operating two years later (Scott, 2014[5]).

• Infectious disease outbreaks: The COVID-19 pandemic demonstrated the significant financial impact of a highly contagious pathogen that required measures to restrict economic and social activity. The reduction in economic activity led to an increase in the unemployment rate in 33 out of 38 OECD countries (OECD, 2021[6]), while underemployment reached its highest levels since at least before the global financial crisis (OECD, 2021[7]). One survey across 43 countries found that 53% of households faced a decrease in income in the first year of the pandemic (2020). (Pinkovetskaia, 2022[8]). Businesses also faced significant declines in revenue. For example, one survey of Canadian businesses found that, relative to April 2019, business revenues in April 2020 had declined by more than 10% for all sectors and more than 30% for the hardest-hit sectors (Statistics Canada, 2020[9]). There was a significant increase in business insolvencies in 2024 across most countries, due in part to the phasing-out of COVID-related fiscal support and the start of repayment obligations for loans provided or supported by governments (Atradius, 2025[10]).

• Cyber attacks and incidents: Cyber attacks and incidents can have a significant financial impact on individuals, households and businesses. For example, individuals impacted by cybercrime could face costs that approximate the financial impact of natural hazards. In Australia, individuals faced an average cost of AUD 30 700 (Australian Signals Directorate, 2024[11]), equivalent to approximately 55% of median personal income in 2021-2022. In the United States, the average cost of cybercrime incidents reported to the Federal Bureau of Investigation by the public in 2024 was USD 19 372, although this figure may include some reporting from small businesses as well as individuals (Internet Crime Complaint Center, 2025[12]). The average claims payment for a cybercrime under a household insurance policy was more than USD 10 000 (Insurance Information Institute and HSB, 2025[13]). For small businesses, average loss estimates range from AUD 49 600 (small businesses) in Australia (Australian Signals Directorate, 2024[11]) to over USD 300 000 across companies in one global study of insurance claims, with a large proportion in the United States (NetDiligence, 2024[14]). One survey of businesses in Canada reported costs of over CAD 100 000 for 41% of the SMEs surveyed (Azimi, 2024[15]). For large companies, average costs can reach up to USD 40 million (NetDiligence, 2024[14]). One survey of businesses in the United States and a number of European countries found that approximately 20% of companies faced solvency concerns as a result of a cyber attack (Hiscox, 2022[16]) while a survey in the United Kingdom found that 37% of companies faced employee reductions after a cyber attack (CIR, 2024[17]).

All of these risks have the potential to be high impact for a significant segment of the population.

• Natural hazards: The number of people affected by natural hazards between 2010 and 2024 accounted for more than 5% of the population (overall) in 15 OECD Members and accession candidate countries, and more than 1% of the population annually on average in 9 OECD Members and accession candidate countries since 2010 (although some individuals were likely affected by multiple events).2 In the United States, 99% of counties have been impacted by flooding since 1996 (National Flood Insurance Program, n.d.[1]). More than 65% of the population or GDP of Chile, Greece, Indonesia, Mexico, the United Kingdom and the United States is located in areas exposed to two or more natural hazards, including cyclones, drought, floods, earthquakes, volcanoes or landslides. More than 80% of the population or GDP of Colombia, Costa Rica, Japan, Korea, Thailand and Türkiye is located in areas exposed to these natural hazards (Dilley et al., 2005[18]). Another study found that more than 20% of the population of Austria, Colombia, Croatia, Indonesia, Japan, Korea, Latvia, the Netherlands and Thailand are exposed to high pluvial, fluvial or coastal flood risk (Rentschler, Salhab and Jafino, 2022[19]).

• Infectious disease outbreaks: Outbreaks involving highly transmissible and highly virulent pathogens, such as COVID-19, have the potential to impact the vast majority of the population, if not the entire population, whether through direct infection or as a result of the containment measures implemented in response. The number of reported COVID-19 cases and deaths3 was equivalent to approximately 10% and 0.09% of the world population, respectively, although the case count could include individuals infected multiple times while both figures could suffer from significant over- or under-reporting (WHO, 2024[20]). Some historical outbreaks have also impacted a significant share of the population, including the 1918-1919 influenza pandemic that affected approximately 25-30% of the world population and led to 50 million deaths (Piret and Boivin, 2021[21]).

• Cyber attacks and incidents: Any individual or business with an internet connection is potentially exposed to a cyber attack or incident and a large share of individuals and businesses have faced cyber attacks or incidents. In the United States, 28% of consumers have had a social media account hacked while 15% experienced an online cyber attack (Insurance Information Institute and HSB, 2025[13]). Most businesses have faced a cyber attack and many face numerous cyber attacks on annual basis. For example, one survey found that, in 2023, 66% of companies across the world had been hit by a ransomware attack (Statista, 2024[22]). According to a survey of companies of varying sizes in 15 developed and emerging markets, 30% of respondents had been affected by ransomware, 42% by online fraud and 47% by a data breach (Munich Re, 2024[23]). A survey of businesses in the United States and several European countries found that companies, on average, faced 49 (Germany) to 80 (Spain) cyber attacks annually (Hiscox, 2024[24]). Unlike natural hazards and infectious disease outbreaks, the vast majority of cyber attacks are idiosyncratic, affecting a single individual or business. However, a single cyber attack or incident could easily affect many policyholders simultaneously. There have been a number of cyber catastrophes “near-misses” and some evidence of an increase in cyber attacks with significant impacts. For example. in the United Kingdom, the National Cyber Security Centre reported that the number of “nationally significant cyber attacks” had more than doubled in the 12 months to September 2025, relative to the previous 12 months (National Cyber Security Centre, 2025[25]). Box 3.1 provides an overview of the types of cyber catastrophes that could occur and some estimates of the potential financial impact.

Recent materialisations of these risks of potential concern have impacted large numbers of households and businesses and have led to significant economic impacts. Table 3.2 provides some estimates of the magnitude of damages and losses from past natural hazards, infectious disease outbreaks and cyber attacks and incidents.

Box 3.1. Cyber catastrophes

The are significant concerns about the potential for a single cyber attack or incident to affect many households or businesses simultaneously, based on: (i) the exploitation of a vulnerability in commonly-used software or hardware; (ii) the mass deployment of harmful, and potentially self-replicating, malware (or ransomware); (iii) an attack or disruptive incident affecting a critical digital services provider, such as a cloud service provider; or (iv) an attack or disruptive incident affecting critical infrastructure services (water, electricity, etc.) (Brew and Lewis, 2025[26]; Lloyd’s Market Association, 2025[27]; Pain, 2023[28]; Romanosky et al., 2025[29]). A number of scenarios have been developed to estimate the potential losses that could materialise as a result of a cyber catastrophe, including a disruption to a major cloud service provider with estimated economic losses of up to USD 23.8 billion¹ (Lloyd’s and AIR Worldwide, 2018[30]) and a financial services payment system disruption that estimated one-year losses of up to USD 15 trillion² (Lloyd’s Futureset and Cambridge Centre for Risk Studies, n.d.[31]).

There have been a number of significant losses affecting multiple companies, including losses due to the spread of computer viruses, particularly in the early 2000s, as well as more recent losses due to attacks on, or disruptions to, critical service providers or service providers critical to specific sectors. Cyber attacks on critical service providers in 2023 and 2024 affected approximately 100 million people around the world in each case.³

However, thus far, economic losses from large-scale cyber events have not reached the magnitude of losses seen for other perils, such as the largest earthquakes or cyclones or the losses seen as a result of COVID-19. One analysis of cyber catastrophes found that, between 1998 and 2023, there were 25 events causing a total of USD 326.4 billion in economic losses, with the largest events causing approximately USD 65-70 billion in losses (inflated to current USD). This analysis also found that more than 90% of the economic losses occurred between 1998 and 2008 (Johansmeyer, 2024[32]; Johansmeyer, 2024[33]).⁴

Notes:

¹ This loss estimate reflects a 5.5 to 11 day disruption to users of a cloud service provider in the United States (Lloyd’s and AIR Worldwide, 2018[30]).

² This loss estimate reflects an extreme scenario that causes a lengthy disruption and a major compromise of transaction data (Lloyd’s Futureset and Cambridge Centre for Risk Studies, n.d.[31]).

³ The breach of the a file transfer service affected approximately 2 800 organisations and 96 million people while the breach of a healthcare payments and claims platform may have impacted up to one third of the US population (Howden, 2024[34]).

⁴ For the purpose of this analysis, cyber catastrophes were defined as events that resulted in more than USD 800 million in losses and affected more than one company (Johansmeyer, 2024[32]).

Table 3.2. Economic impact of selected major events

	Direct damages or financial losses
COVID-19	USD 1 200 – 1 600 bn
Great East Japan Earthquake (2011)	USD 211.3 bn
Hurricane Katrina (2005)	USD 128.3 bn
Thai Floods (2011)	USD 46.5 bn
Canterbury Earthquakes (2010-2011)	NZD 40 bn
Cyber incident at cybersecurity vendor (2024)	USD 5.4 bn
Queensland Floods (2010-2011)	AUD 5.7 bn
Cyber incident at healthcare service provider (2024)	USD 4.5 bn

Source: COVID-19 loss estimates are from Wolfrom (2022[35]), Could insurance provide an alternative to fiscal support in crisis response?; Great East Japan Earthquake loss estimates are from Kajitani, Chang and Tatano (2013[36]), Economic Impacts of the 2011 Tohoku-oki earthquake and tsunami; Hurricane Katrina loss estimates are from GAO (2020[37]) Natural Disasters: Economic Effects of Hurricanes Katrina, Sandy, Harvey, and Irma; Thai Floods loss estimates are from World Bank (2012[38]), Thai Flood 2011: Rapid Assessment for Resilient Recovery and Reconstruction Planning (Overview); Canterbury Earthquakes loss estimate are from Potter et al. (2015[39]), An overview of the impacts of the 2010-2011 Canterbury earthquakes; Queensland Floods loss estimates are from Deloitte Access Economics (2016[40]), The cost of natural disasters: Australian experiences and Reserve Bank of Australia (2011[41]), Statement on Monetary Policy. The loss estimates for the two cyber incidents are from Guasch Garcia and Pujol (2025[42]), Top 10 Cyber Incidents 2024.

3.3. Assessing the adequacy of financial protection

The framework proposes that governments undertake an assessment of the adequacy of financial protection for the risks of potential concern to identify potential unprotected financial exposures. This assessment should examine the availability, affordability and take-up of insurance coverage offered through private insurance markets, including public-private insurance programmes, the sufficiency of that coverage in mitigating financial exposures, as well as any financial protection that could be available through social insurance arrangements established for other purposes (Table 3.3).

Table 3.3. Adequacy of financial protection for natural hazard, cyber and infectious disease outbreak risks

	Availability of sufficient financial protection	Affordability of financial protection	Take-up of financial protection
Natural hazard risks	Generally available to households and businesses although may include high deductibles or low limits for some hazards or some consumers	Unaffordable in some regions for a moderate share of high-risk households and businesses, and concerns about increasing premium rates	Take-up of coverage in some countries is relatively low
Infectious disease outbreaks	Very limited financial protection available for businesses revenue losses	Not evaluated (coverage not generally available)	Not evaluated (coverage not generally available)
Cyber attacks and incidents	Mostly available to households and businesses although some businesses have faced challenges in access, and exclusions for potentially significant risks are usually applied	Price increases have been significant in some years for some businesses although recent moderation	Take-up of coverage is relatively low among SMEs

3.3.1. Availability of financial protection

Natural hazard risks

Financial protection against most natural hazard risks is generally available in OECD Members and accession candidate countries, either from the private insurance sector or through public-private insurance programmes. For example, the availability of insurance coverage in the 23 European countries examined by EIOPA was only estimated as “low” for one or two natural hazard perils in five countries.4 An examination of the household insurance market in the United States found that non-renewal rates (i.e. the share of annual insurance policies that insurers decided not to renew due to the risk profile of the property) were below 2% on average (for 2018-2022), even in high-risk areas (Federal Insurance Office, 2025[43]). However, households in some regions within some countries face difficulties in accessing insurance coverage for specific types of natural hazards. For example, one recent report identified insurance availability challenges in 10 US states5 and for approximately 10% of Canadian households deemed to be at high risk of flooding (Golnaraghi and Vichev, 2025[44]). As outlined in chapter 4, challenges also exist in accessing insurance coverage for wildfire losses in high-risk areas in a few countries.

Insurance coverage for natural hazard risks will usually provide sufficient coverage to respond to the major types of losses that individuals, households or businesses could face. Property insurance that includes coverage against natural hazard risks usually provides financial protection against damage to property and revenue losses (i.e. business interruption) for businesses and for damage to property and temporary living expenses for households. Individuals that face a loss of income due to disruptions to economic activity in the affected region may be eligible for government-supported unemployment insurance or benefits in most countries.

However, coverage for business interruption and temporary living expenses may be subject to limits that could lead to unprotected financial exposures for businesses and households. In addition, for some risks or for some policyholders, high deductibles or low limits on sum insured may be applied6 which could result in large, unprotected exposures in some cases. Financial protection for mortality and morbidity risks related to natural hazard risks is generally available through health and life insurance policies. Health care needs or costs would also be directly provided or covered through health insurance arrangements established in most countries.

Infectious disease outbreaks

Financial protection for mortality and morbidity risks related to an infectious disease outbreak is generally available in relevant health and life insurance policies offered by private insurers, and there does not appear to be any exclusions applied. In many countries, basic health care is either directly provided by governments at no cost or financial protection for health costs is provided through a social insurance arrangement.

Where constraints on economic activities are imposed, individuals that face a loss of income may be eligible for government-supported unemployment insurance or benefits.7 However, the availability of private insurance coverage for business revenue losses is very limited as a result of conditions and exclusions applied in property insurance policies.8 Since COVID-19, insurers have reportedly tightened “communicable disease” exclusions and are consistently applying an exclusion in property and business interruption policies (Marsh, 2021[45]; Dennis, 2024[46]; Curtis, 2022[47]). As a result, the only coverage available for business interruption related to infectious disease outbreaks is through a very limited specialty market for epidemic risks coverage.9 Significant ex post financial protection was provided by governments to address unprotected losses in income and revenue. This financial protection was provided as public compensation and financial assistance (e.g. grants, loans, loan guarantees) that was implemented as a specific response to the impacts of COVID19, not as part of a pre-established government-supported financial protection arrangement.

Cyber attacks and incidents

Financial protection against cyber attacks and incidents is generally available through private insurers, either in a stand-alone cyber insurance policy or as a covered peril in some property, liability, crime or other insurance policies (OECD, 2021[48]). The financial protection offered by private insurers to individuals and households generally covers losses and extra expense related to the fraud, extortion, data breach and other forms of cybercrime. The financial protection available from private insurers for businesses usually covers the main potential financial impacts, including revenue and other financial losses such as theft of funds, extra expense and costs related to liability and fines and penalties, to the extent allowed by law.10

However, access to cyber insurance coverage may not be available for all businesses while coverage may not be offered to many individuals and households.11 For example, a global survey of risk managers found that 8% of respondents were not able to access cyber insurance coverage (FERMA, 2024[49]). Another report found that 28% of companies with less than 250 employees were unable to acquire or renew cyber insurance coverage in 2023 (Hoffman, 2024[50]). In addition, limits on the amount of covered losses and sub-limits for some types of losses, such as business interruption, are often applied (Pain, 2023[28]) which could leave businesses with unprotected exposures. In 2024, 35% of risk managers reported a reduction in available coverage (FERMA, 2024[49]). The limits on coverage may be particularly challenging for large businesses seeking higher amounts of coverage (Romanosky et al., 2025[29]).

Some types of cyber attacks and incidents are usually not eligible for coverage, including through the application of war and infrastructure exclusions (Ruiz, 2023[51]; GFIA, 2023[52]; Romanosky et al., 2025[29]; Pain, 2023[28]). Critical national infrastructure exclusions are commonly applied to losses resulting from a failure of a satellite, electricity interruptions and gas, water, telecommunications and other infrastructure outages (Romanosky et al., 2025[29]; Ruiz, 2023[51]), and may also be applied to key components of the infrastructure that operates the internet, such as domain name system or certificate system providers (Pain, 2023[28]). Coverage for cloud service disruptions is, however, often included (Pain, 2023[28]), although this coverage is reportedly more limited in Europe and Asia-Pacific (Guy Carpenter, 2025[53]) and is often subject to waiting periods of 8 to 24 hours before coverage is triggered (Hemenway, 2025[54]). Cyber war exclusions vary across policies although commonly aim to exclude hostile attacks where the attackers are under the control of a nation-state or acting on its behalf and where the attack is a widespread event and/or has a major detrimental impact on the capacity of the state to function (Miller, 2023[55]; Pain, 2023[28]). Some of these exclusions could have a material impact on the overall adequacy of available cyber insurance coverage (Box 3.2).

Box 3.2. Potential implications of cyber insurance exclusions and limitations

Cyber insurance exclusions and coverage limitations related to cloud service disruptions and nation-state attacks could leave many businesses with significant unprotected financial exposures to cyber risks.

Cloud service disruptions can affect thousands of businesses simultaneously and lead to significant business interruption losses for those impacted. For example, a 15-hour cloud service outage for US customers in October 2025 reportedly affected more than 2 000 large organisations and up to 70 000 in total (Essen, 2025[56]; Hemenway, 2025[54]). Early overall loss estimates from the disruption ranged from USD 565 to USD 740 million (CIR, 2025[57]), although the application of 8-12 hour waiting periods before coverage is triggered (Essen, 2025[56]) and other factors meant that insured losses were expected to be only USD 40 million (Hemenway, 2025[54]).

Growing geopolitical tensions could increase the frequency of cyber attacks executed by nation-states or related entities, whether for the purposes of harming adversaries, creating chaos or stealing funds (Collins, 2024[58]; WEF, 2024[59]). One analysis of “major state-affiliated cyber attacks”¹ found an increase in the number of attacks from approximately 20 per year between 2007 and 2010 to more than 120 per year since 2019 (Howden, 2024[34]). A recent survey of information security professionals from the United Kingdom and the United States found that 32% were extremely concerned and 37% were somewhat concerned that a state-sponsored cyber attack could target their business (Muncaster, 2025[60]). Major disruptive attacks affecting a large UK retailer and a large UK automotive company in 2025 may have been part of escalating state-sponsored hybrid attacks in Europe, according to an official from the North Atlantic Treaty Organization (Reynolds, 2025[61]).

Note: ¹ The analysis is based on the types of entities targeted, with major attacks against government agencies and defence and high-tech companies identified as “state-affiliated” attacks (Howden, 2024[34]).

3.3.2. Affordability of financial protection12

Natural hazard risks

The cost of insurance coverage for some natural hazard risks may be, or may be becoming, unaffordable in some regions of the world. More than 25% of households or businesses in 4 of the 17 European countries included in an analysis by EIOPA could face insurance coverage for some or all natural hazard risks that is unaffordable.13 In Australia, a recent analysis found that approximately 15% of households faced household insurance premiums that cost more than four weeks of gross household income14 in 2024, driven in part by the cost of coverage for natural hazard risk (Paddam et al., 2024[62]). Businesses are also facing challenges in accessing affordable coverage. One recent survey of larger businesses headquartered in North America, Europe and Asia-Pacific found that 44% had chosen not to secure full coverage for their exposure to extreme weather risks as a result of the cost of coverage (FM, 2025[63]). The cost of property insurance coverage is increasing in many countries, partly as a result of increasing natural hazard risks. The OECD’s Global Insurance Market Trends 2024 found that the nominal growth rate of the price of dwelling insurance in 2023 was above 5% in just over half of the OECD countries for which data was available (OECD, 2024[64]). The cost of household insurance in the United States increased at a rate of 8.7% above inflation between 2018 and 2022 (Federal Insurance Office, 2025[43]) and has increased by 40.4% overall since 2019 (Davis, 2025[65]). In some US states, average household insurance premiums increased by more than 40% between 2020 and 2023 alone15 (Golnaraghi and Vichev, 2025[44]). Average household insurance premiums increased by 7.7% between 2023 and 2024 in Canada, 10% in Australia and approximately 20% in the United Kingdom (Golnaraghi and Vichev, 2025[44]). As outlined in chapters 4 and 5, there appears to be some moderate challenges in the affordability of flood insurance coverage in a few countries and more significant challenges in the affordability of wildfire insurance in high-risk areas in Canada and the United States.

Cyber attacks and incidents

Some businesses may perceive cyber insurance coverage as unaffordable or at least too expensive relative to the perceived benefits of coverage. A global survey of companies of different sizes found that 33% of those that did not acquire coverage indicated that the cost of coverage was the main factor (Munich Re, 2024[23]). The cost of cyber insurance coverage has increased significantly since 2020. According to one report, about 70% of organisations that renewed their coverage in 2023 faced premium increases of more than 50% (Hoffman, 2024[50]). Companies in some sectors, such as health care, continue to face challenges in securing affordable coverage (Howden, 2024[34]; Amwins, 2024[66]). The cost of cyber insurance has declined more recently, although premiums costs remain significantly above levels in 2020 (Howden, 2025[67]; Swiss Re, 2025[68]; The Council, 2025[69]). The cost of personal cyber coverage offered by private insurers is reportedly low and likely affordable (less than USD 3 per month) (Schlichter, 2023[70]).

3.3.3. Take-up of financial protection

Natural hazard risks

The take-up of insurance coverage for some or all natural hazard risks is relatively low in many OECD Members and accession candidate countries. In Europe, for example, EIOPA has reported that “insurance penetration”16 among households is below 50% for at least one natural hazard peril in 20 of the 27 countries examined,17 and often below 25% (EIOPA, 2025[71]). In Greece, for example, only 14% of households have property insurance coverage against weather-related hazards and earthquakes (Hellenic Association of Insurance Companies, 2025[72]). In Portugal, only 19% of households have coverage for earthquake risk (ASF, 2024[73]). In Italy, approximately 25% of small businesses (10-49 employees) and 7% of micro businesses (less than 10 employees) have insurance coverage for natural hazard risks (Persano Adorno, 2025[74]). In addition, a large share of economic losses between 2000 and 2024 in OECD Members and accession candidate countries were uninsured (53% of cyclone losses, 71% of flood losses and 79% of earthquake losses),18 reflecting a lack of availability, affordability or take-up. In 21 OECD Members and accession candidate countries,19 less than 20% of economic losses from natural hazards since 2000 were insured, and less than 50% were insured in almost two-thirds of countries.20

Cyber attacks and incidents

Data on the level of take-up of insurance coverage for cyber risks is available from various surveys undertaken by insurance companies, intermediaries and others. The take-up rates can vary across different surveys although most estimates find relatively high take-up among large organisations, usually between 60-85% (Bueermann. Gretchen and Rohrs, 2024[75]; Munich Re, 2024[23]; Swiss Re, 2025[68]). However, most surveys find low take-up among SMEs, ranging from 10-30% (Bueermann. Gretchen and Rohrs, 2024[75]; Munich Re, 2024[23]; Swiss Re, 2025[68]; Howden, 2025[67]). Some surveys have found much higher take-up among SMEs, up to 71% in one survey based on responses from companies in France, Germany, Ireland, Portugal, Spain, the United Kingdom and the United States (Hiscox, 2025[76]). Others have found lower levels of overall cyber insurance take-up, including one analysis that estimates take-up rates of below 30% in France, Germany, Italy and Spain, and below 40% in the United Kingdom (Howden, 2025[67]). The take-up of personal cyber insurance coverage by individuals is very low (Insurance Information Institute and HSB, 2025[13]).

3.4. Evaluating the need for government-supported financial protection

Governments should evaluate the potential economic, social and/or financial consequences of the unprotected financial exposure that results from inadequate financial protection to determine whether there is a need for government-supported financial protection. This evaluation should consider: (i) factors linked to the nature and implications of the risk exposure, such as the potential frequency of significant economic, social or financial impacts, the impact of the risk exposure on economic activity, and the distribution of potential losses across segments of society; and (ii) factors linked to the potential for expanding financial protection for the unprotected exposures, such as the ability of private insurance markets to establish a pool of uncorrelated exposures, quantify potential losses, address information asymmetries, moral hazard and adverse selection, and achieve economic feasibility.

3.4.1. Factors linked to the nature and implications of the unprotected financial exposure

Governments should consider several factors linked to the nature and implications of the unprotected financial exposure as part of this evaluation (Table 3.4). Risks that are likely to lead to more frequent or severe unprotected financial exposures should be prioritised along with those likely to have a greater impact on more vulnerable segments of the population who will have less capacity to respond to unprotected financial exposures. In addition, risks that can lead to unprotected financial exposures that impede economic activity, such as by limiting access to credit, should also be prioritised.

Table 3.4. Risk characteristics and potential implications of unprotected financial exposure to natural hazard, infectious disease outbreak and cyber risks

	Frequency and severity	Implications for economic activity	Loss distribution affecting vulnerable
Natural hazard risks	Frequent severe losses and increasing weather-related losses	High and increasing impact on access to credit	Some evidence of disparate impact as vulnerable populations may face higher exposure
Infectious disease outbreaks (income losses)	Rare but very severe losses and possibility of higher frequency in the future	No hindrance to economic activity	Some evidence of disparate impact in terms of health, income and revenue losses (more exposed sectors)
Cyber attacks and incidents (cyber catastrophes)	Frequent and increasing attacks although few cyber catastrophes, possibility of increase in cyber catastrophes due to geopolitical tensions	Increasing impact on business activity through contractual requirements for coverage	Some evidence of disparate impact on small businesses as attractive targets of cybercrime and lower defensive capacity

Likelihood, frequency and severity of the risk

In evaluating the need for the need for government-supported financial protection, governments should prioritise risks that have a greater likelihood of materialising, the potential to occur more frequently, the potential for more significant financial impacts on individuals, households and businesses and/or those that could potentially impact a larger share of the population. A risk that could have very high and widespread impacts should also be prioritised, even if the likelihood that it could materialise is relatively low.

Major natural hazard events can occur frequently. For example, between 2010 and 2024, annual economic losses from floods exceeded USD 1 billion in nine years in Japan, eight years in Italy, six years in Australia, Canada and Germany, four years in France and three years in the United Kingdom. Meanwhile, convective and winter storms have resulted in annual economic losses above USD 1 billion in eleven years in Germany and five years in France. Japan and Mexico faced annual tropical cyclone losses exceeding USD 1 billion in eight years and seven years, respectively. Japan has also faced annual losses from earthquakes exceeding USD 1 billion in nine years since 2000 while Indonesia has faced such losses in five years. In the United States, combined annual economic losses from floods and convective storms have exceeded USD 10 billion in every year between 2010 and 2024 and exceeded that amount in nine years as a result of tropical cyclones and three years as a result of wildfires.21

A changing climate is expected to lead to more frequent and severe losses from natural hazards. For example, one analysis projects that average annual damages from natural hazards in the United States could be 26% higher in 2050 relative to 2020 (Lutz, Lafakis and Rudaviciute, 2025[77]). Overall, the level of economic losses from natural hazards in OECD Members and accession candidate countries in the most recent decade (2015-2024) is approximately 20% higher than the previous decade (2005-2014). Weather-related losses increased by 48% (in constant 2024 USD) while losses resulting from earthquakes declined by close to 60%.22 One recent analysis found that weather-related losses between 2020-2024 in Brazil, Canada, France, Germany, Italy and the United States were higher as a share of GDP than any of the preceding decades since 1980 (Grimm and Hanselmann, 2025[78]).

Infectious disease outbreaks occur with some frequency although major events approximating the scale of the COVID-19 pandemic are very rare. Since 1950, there have been three major influenza outbreaks (1957, 1968 and 2009) and two coronavirus outbreaks (2002 and 2012), in addition to COVID-19, although all of the outbreaks resulted in much lower infection and mortality rates than COVID-19 (Piret and Boivin, 2021[21]). However, the frequency of severe infectious disease outbreaks could be increasing. For example, one study that incorporated changes in zoonotic spillover, global travel patterns and factors such as the prevalence of armed conflicts estimates that a respiratory pandemic causing approximately 10 million deaths has a 4.2% annual probability of occurring (i.e. approximately a 50% chance of occurring in the next 25 years) (Madhav et al., 2023[79]). A risk model provider for epidemic risks has provided a similar estimate of the annual probability of an outbreak on the scale of the COVID-19 of 2.5-3.3% (22-28% in the next 10 years and 47-57% in the next 25 years (Kraut, La Bonté and Richter, 2025[80]). Continued habitat encroachment, urbanisation and a changing climate are likely to increase the frequency of infectious disease outbreaks in the future (The Vaccine Alliance (Gavi), 2020[81]; Whiting, 2020[82]; Piret and Boivin, 2021[21]).

Cyber attacks and incidents occur frequently, and the frequency is increasing.23 There is a lack of reliable estimates of the frequency of cyber catastrophes that could lead to widespread losses. According to one estimate, there were 25 “cyber catastrophes” between 1998 and 2024, with most occurring between 2001-2008, although with four events in 2024 (Johansmeyer, 2024[32]; Johansmeyer, 2024[33]).24 As highlighted in Box 3.2, there is increasing concern about, and some evidence of, growing exposure to major state-affiliated cyber attacks (Howden, 2024[34]). Increasing dependence on key information technology services is also leading to growing concerns about single points of failure that could lead to disruptions for a significant number of businesses dependent on that service (Aon, 2025[83]). Recent cyber attacks and incidents affecting providers of payment technologies, cybersecurity services and software for specific sectors have demonstrated the broad scope of potential dependencies (i.e. beyond core infrastructure such as cloud service providers) that can lead to impacts for a large number of companies (Aon, 2025[83]).

Implications for economic activity

The evaluation should also take into account the implications of the unprotected financial exposures of individuals, households and businesses to a risk of potential concern on their ability to participate in economic activities. For example, unprotected financial exposure to a risk may impede access to credit, including mortgage loans as well as investment and working capital, or could hinder transactions with parties that impose a requirement for insurance coverage. Risks that create these types of ex ante hindrances to economic activity likely warrant particular attention when evaluating the need for government-supported financial protection.

Mortgage lenders in some countries require households to have insurance coverage for natural hazard risks in order to obtain a mortgage. As a result, a lack of insurance availability could have an impact on credit availability. The requirements for insurance coverage against natural hazard risks could become more stringent due to the increasing awareness of lenders, and financial sector supervisors, of the potential consequences of unprotected exposures to natural hazard risks.25 Banks in some countries are denying mortgages and other loans in communities at higher flood risk due to a lack of insurance availability or a potential future lack of insurance availability (Blickle et al., 2023[84]; Shingler, 2024[85]; Shankleman, 2024[86]). One major credit rating agency recently issued a request for market feedback on incorporating physical climate risks into credit assessments of the mortgage-backed securities and covered bonds that many banks issue to fund lending (Rossiter and Albers, 2025[87]). In addition, insurance costs are increasingly impacting real estate development in some high-risk areas (Torarp et al., 2025[88]), although this could also have benefits if it hinders development in areas that are highly exposed to natural hazards.

Financial protection against the consequences of infectious disease outbreaks does not appear to have any impact on access to credit. There is no evidence that lenders require an individual, household or business to have coverage to protect against the financial impacts of an infectious disease outbreak as a condition for accessing credit.

Similarly, lenders do not usually require households or businesses to have financial protection against cyber attacks and incidents in order to access credit. However, some businesses are requiring their suppliers to have insurance coverage for cyber attacks and incidents as a condition in their contractual arrangements. Some insurers have identified such contractual requirements as a driver of cyber insurance take-up and have indicated that the requirements are sometimes leading individual companies to acquire higher cyber insurance limits (Amwins, 2024[66]). This suggests that these requirements are increasingly common and also that the adequacy of coverage is being taken into account. However, one examination focused on the United States found no evidence that limitations in the availability of cyber insurance is leading to any significant reduction in economic activity (Romanosky et al., 2025[29]).

Distribution of potential losses

The evaluation should also take into account the distribution of possible losses linked to risks of potential concern across segments of society, with a focus on individuals, households and businesses that are unlikely to have sufficient financial capacity to absorb unprotected losses without facing significant financial stress.

Natural hazards can impact households with different levels of income and wealth and businesses of varying size, potentially indiscriminately. However, there is some evidence that more vulnerable populations are more likely to reside in communities with greater exposure to natural hazard risk. For example, one study on the level of exposure to wildfire, flood, and hurricane and storm risk in the United States found that, at a national level, a higher share of Hispanic households are located in areas facing high wildfire risk, relative to households from other racial backgrounds, and that a higher share of Black households are significantly exposed to hurricane and storm risk (Ng, 2025[89]). Similar disparities were also found in some specific communities. For example, in the US city of New Orleans, a higher share of Asian American, Black and Hispanic households are located in high-risk flood areas (Ng, 2025[89]). In addition, there are likely to be differences in terms of the capacity of lower income households and small businesses to protect themselves from the physical impacts of natural hazard events which could inflate the share of losses borne by these segments of the population. Another study focused on the United States found a positive correlation between flood risk and various indicators of social vulnerability, including racial background, linguistic isolation, the presence of vacant homes and housing type and ownership (i.e. renters and mobile homes faced higher risk) (Asl et al., 2025[90]). In Canada, a study found that neighbourhoods with higher levels of economic dependency (e.g. reliance on social assistance, higher dependency ratios (such as more children and seniors) and situational vulnerability (e.g. lower value homes, single-income households, lower education levels) faced more frequent flooding than other neighbourhoods (Foran, Sinha and Pinault, 2025[91]).

While the health consequences of infectious disease outbreaks could potentially impact any individual, regardless of wealth or income, a number of examinations of the impact of COVID-19 have found that mortality was significantly higher among low-income segments of the population, both within and across countries (McGowan and Bambra, 2022[92]).26 This could reflect both a higher level of exposure to infectious diseases as well as a lower level of protection against severe consequences, for example in terms of access to health care. Restrictions on economic activity imposed in the context of infectious disease outbreaks would likely have more significant impacts on businesses and employees in certain sectors, such as tourism, hospitality and retail (amongst others).27 These sectors could have a greater concentration of employees with below average salaries.

Cyber attacks and incidents most often affect businesses although individuals are also exposed to this risk. Claims data from insurance companies indicate that small businesses are significant targets of cyber attacks, accounting for 98% of claims in one report on the claims experience of multiple insurers (NetDiligence, 2024[14]) and 75% of ransomware victims in the claims experience of another (Altman, 2025[93]). SMEs usually account for a significant share of the number of business although the take-up of cyber insurance coverage is lower among SMEs. If these shares indicate a higher level of exposure, it may be the result of either targeting by cyber criminals of the smaller companies that are perceived to be more vulnerable or a higher success rate when targeting SMEs. The impacts on small businesses might also be more severe even if the average loss faced by SMEs is significantly lower than the average loss faced by larger businesses. For example, one survey of small businesses in North America found that 55% of small businesses would cease to operate if they faced financial impacts of USD 50 000 and that 32% could even go out of business as a result of financial impacts as low as USD 10 000 or less than a day of downtime (VikingCloud, 2025[94]). However, the distribution of losses from cyber catastrophes could be different. SMEs are likely to be equivalently exposed to some types of cyber catastrophes, such as disruptions to critical infrastructure or digital services or mass malware attacks. However, large-scale attacks affiliated to nation-state actors are more likely to be targeted at larger, more strategic companies.

3.4.2. Factors linked to the potential for expanding financial protection

Government should also undertake an evaluation of the potential for private insurance markets to provide further coverage and reduce unprotected financial exposures. This potential is likely to be constrained for risks that do not meet the criteria necessary to be considered an insurable risk. Risks related to natural hazards, cyber catastrophes and losses of income and revenue in the context of major infectious disease outbreaks have characteristics that could hinder their insurability. The evaluation should consider the ability of private insurance markets to establish a pool of uncorrelated exposures, quantify potential losses, address information asymmetries, moral hazard and adverse selection, and achieve economic feasibility (Table 3.5).

Table 3.5. Potential impediments to expanding financial protection for natural hazard, infectious disease outbreak and cyber risks

	Limited risk diversification through reinsurance	Significant challenges in risk quantification	Information asymmetries, moral hazard, adverse selection	Challenges to economic feasibility
Natural hazards	Significant reinsurance market appetite for catastrophic losses	Catastrophe models for many hazards and regions although gaps in coverage and concerns about uncertainty related to climate change impacts	Adverse selection risk for better understood hazards	Low risk awareness of infrequent hazards Moderate expectation of post-event financial assistance
Infectious disease outbreaks	Reinsurance market appetite for business disruption risk is untested although there are concerns about correlated losses and correlation with financial markets performance	Quantification challenges due to complexity of risk assessment (pathogen spread/treatment, government restrictions). Very few models for business disruption risk	Adverse selection for risks related to potential restrictions on economic activity	Significant expectation of post-event financial assistance, amplified by perceptions of government responsibility for restrictions and resulting losses
Cyber-attacks and incidents	Limited (but potentially growing) appetite for coverage of catastrophic losses	Quantification challenges related to technological development, attacker/defender capacities. Increasing confidence in models (although more limited for catastrophe losses)	More limited risk of adverse selection given wide range of attacker motivations	Lower expectation of post-event financial assistance, with the exception of state-affiliated attacks

Ability to establish a pool of uncorrelated exposures

Private insurance markets face challenges in providing financial protection against risks that could simultaneously impact a large number of individuals, households or businesses. Natural hazard risks, infectious disease outbreaks and cyber catastrophes all have the potential to affect a large number of individuals, households and businesses simultaneously. Insurance companies would have to set aside significant capital to protect against the possibility of a large, correlated loss that deviates substantially from expected losses (Hartwig and Gordon, 2020[95]; Schanz, 2020[96]), which would raise the cost that policyholders will have to pay for financial protection.

A critical consideration is whether some portion of a risk that could lead to correlated losses in one region or country can be transferred to international reinsurance and capital markets (Romanosky et al., 2025[29]). International reinsurance and capital markets can assume risks from a wide variety of regions and countries28 and therefore create a more diversified pool of risks, leading to a lower overall cost of coverage. These diversification benefits can be captured for risks that are not correlated geographically, such as natural hazard risks, and international reinsurance and capital markets play a significant role in assuming natural hazard risks.

There has been substantial and increasing reinsurance and capital market appetite to assume natural hazard risks. For example, the largest reinsurers’ catastrophe budgets in 2025 were more than 1.6x their budgets in 2020 in nominal terms29 while the value of outstanding catastrophe bonds and insurance linked securities, which are mostly issued to cover natural hazards risks, increased by a similar amount.30 At the same time, primary insurer retention levels have substantially increased in recent years,31 suggesting an overall increase in insurance market appetite for natural hazard risks.

It is difficult to provide any assessment of the potential appetite of reinsurance markets for the income and revenue losses related to infectious disease outbreaks given the lack of primary insurance market coverage for this risk. It is almost certain that there would be significant concerns about the limited ability to diversify this risk geographically, which would constrain reinsurance market appetite. The potential that losses would be correlated with financial market downturns could also limit capital market appetite as investors in insurance-linked securities tend to be attracted by returns that are uncorrelated with financial market performance (OECD, 2021[97]).

Reinsurance and capital market appetite for reinsuring losses resulting from cyber catastrophes appears more limited, reflecting in part the inability to diversify these risks geographically as well as concerns about large correlated losses. A significant share of cyber risk is transferred to the reinsurance market (approximately 36% of gross written premium for 2025) (Howden Re, 2025[98]). However, the vast majority, of reinsurance for cyber risks, just under 90%, is provided on a proportional basis (Howden Re, 2025[98]), with very limited use of the non-proportional reinsurance coverage that is usually accessed to address catastrophe losses. There is also very limited use of retrocession by reinsurers (only 7% of reinsurer premiums is retroceded) and less than a quarter of the risk transferred to retrocession markets is transferred on a non-proportional basis (Howden Re, 2025[98]). The share of non-proportional reinsurance coverage and use of retrocession markets has increased over the years although the reinsurance market for cyber risks remains highly concentrated with only a handful of active reinsurers (Howden Re, 2025[98]). The capital market appetite for cyber risk is also limited as only 1.9% of the outstanding value of catastrophe bonds and insurance-linked securities is dedicated to cyber risks (Artemis, n.d.[99]). However, there are some signs of increasing demand as a recent catastrophe bond with an excess-of-loss coverage issued by one insurers was able to attract 50% more in investment than initial targets (Willard, 2025[100]).

Challenges in quantifying potential losses

Insurance companies need to have the ability to estimate the potential value of claims under the insurance coverage that they provide in order to set the premium rate for coverage and to manage the financial exposure they assume through capital, reserves and risk transfer to reinsurance and capital markets. As a result, insurance companies may be reluctant to provide financial protection against risks that are difficult to assess and quantify, or may charge very high premium rates to compensate for uncertainty. The potential financial impacts of risks related to natural hazards, infectious diseases and cyber attacks and incidents are difficult to assess and quantify due to their relative infrequency, the complexity of the human and natural factors driving these risks, and the evolutions in hazard, exposure and vulnerability that could significantly impact losses over time.

Natural hazard risks materialise relatively infrequently. As a result, there is a limited amount of historical data on their frequency, severity and financial impact, which makes it more difficult for insurance companies to assess and quantify potential losses using traditional actuarial and statistical methods. A changing climate adds further challenges. The uncertainty in the trajectory of future emissions and exposure, the level of investment in risk reduction and adaption, and the ultimate impact of changes in climate parameters on the frequency and intensity of extreme events all add complexities to the assessment of natural hazard risks (OECD, 2023[101]). For example, one catastrophe modelling firm’s assessment of the potential impact of climate change by 2100 on the frequency of tropical and extratropical cyclones, severe convective storms, wildfires and inland and costal floods of varying severities found a significant range in potential changes for each of the perils examined (Sousounis and Little, 2017[102]).

Major infectious disease outbreaks that result in restrictions on economic activity have rarely occurred and therefore there is limited data on the frequency, severity and impact of large-scale outbreaks. Assessing this risk is complex given the broad range of possible outbreak scenarios and responses. Pathogens differ in terms of their transmissibility and virulence and have different capacities to adapt or mutate over time (GAO, 2023[103]). Consumer reactions to an infectious disease outbreak are likely to vary across and within countries and will have an impact on the scope of any activity restrictions imposed by governments. The duration of an outbreak will depend on government actions and the capacity of the health sector to develop effective treatments and vaccines. In addition, the likelihood of many different types of outbreaks is likely to evolve in the future with changes in urbanisation, mobility and contact with animals through habitat encroachment.

There is also limited historical data on cyber attacks and incidents, given that this risk has emerged only in recent decades. There is increasing data on some types of idiosyncratic cyber attacks and incidents that occur with greater frequency. However, there are still very few occurrence of cyber catastrophes which limits the ability of insurers to estimate accumulation risks (Howden, 2024[34]; Pain, 2023[28]). The assessment and quantification of cyber risks is complicated by the need to evaluate the motivations and capabilities of criminals or other hostile actors and the effectiveness of those charged with defending against such attacks. Cyber risk is also extremely dynamic as new vulnerabilities continuously emerge (Caron, 2025[104]) and as attackers and defenders adapt to each other’s tactics (Pain, 2023[28]). New technological capabilities will provide both cyber attackers and defenders with new tools and create new sources of exposure. For example, cyber criminals are beginning to leverage artificial intelligence and large language models to enhance the speed and scope of ransomware attacks, develop new malware and improve social engineering tactics, including through the use of deep fakes (Allianz Commercial, 2024[105]; von dem Knesebeck and Kreuzer, 2024[106]; Howden, 2024[107]). Increasing digitalisation and the expansion of 5G networks will increase the volume of connected devices that are vulnerable to attacks and that are not always highly secure (Allianz Commercial, 2024[105]).

The insurance sector has developed sophisticated catastrophe models that incorporate both existing and hypothetical events as a means to address some of the challenges in assessing low-frequency risks with limited historical data. These models are most advanced for natural hazards for which probabilistic models have been developed for many parts of the world and for many perils, particularly where there is more substantial insurance coverage. However, important gaps in natural hazard model coverage remain. Modelling of cyber risk is more recent although confidence in these models in increasing (Blosfield, 2025[108]). There are important gaps in the availability of tools for estimating complicated (e.g. business interruption and supply-chain disruptions) and emerging risks like physical damage and bodily injury (Romanosky et al., 2025[29]). There are also significant challenges in modelling cyber catastrophes which has led to large variations in model outputs and limited confidence.32 Mortality risks related to infectious disease outbreaks are often incorporated in catastrophe models for life insurance risks although these models do not estimate losses due to disruptions in economic activity.

Addressing information asymmetries, moral hazard and adverse selection

Risks that could entail significant information asymmetries or risks of adverse selection and moral hazard could be challenging for insurance companies to assume if those risks cannot be mitigated. There are likely to be more limited information asymmetries for complex risks related to natural hazards, cyber attacks and incidents and infectious disease outbreaks as individuals, households and businesses are unlikely to be better able to assess their exposure to damages and losses than insurance companies. It is also unlikely that moral hazard due to the existence of insurance protection will be any more significant for these risks than for other types of insured risks, or that mitigation measures such as risk-based pricing and deductibles and other types of co-insurance will be any less effective.

Adverse selection is likely to be more problematic and could limit the ability of insurance companies to establish a pool that contains both low- and high-risk individuals, households and businesses. Some communities and some individual households and businesses are clearly less exposed to earthquakes, floods and cyclones than others and are likely to be less willing to pay a premium for financial protection against those risks. Similarly, businesses that operate in sectors that are unlikely to face severe restrictions in the context of an infectious disease outbreak would also be less interested in acquiring financial protection. The same could be true for cyber risks. For example, businesses that make more significant fund transfers or that collect substantial personal data may perceive themselves to be a more attractive target for cybercriminals while the operators of critical digital services or infrastructure might perceive themselves to be a target for cyber attacks with a disruptive motive. However, the complexity of deciphering the motivations and capabilities of those perpetrating cyber attacks would likely limit the potential for adverse selection among potential insureds (Romanosky et al., 2025[29]).

Achieving economic feasibility

A disparity between insurers’ assessment of the exposure, reflected in the premium rates that they demand, and the perceived value of financial protection for households, individuals and businesses could limit the economic feasibility of private insurance as a source of financial protection. All of the factors above would have an impact on the premium rates that insurance companies would demand to provide financial protection. Financial protection available from private insurance companies against risks with significant potential for correlated losses, substantial uncertainties and that carry a risk of adverse selection will usually only be offered at higher cost. At the same time, risk awareness among potential insureds will likely be low for all of these risks given their inherent infrequency and a likely expectation of government financial assistance to address the impacts of a major catastrophe. This expectation is likely to be greatest for risks where governments have provided significant support in the past or where the government may be perceived as having a critical role in preventing the risk. These factors would be expected to reduce the amount that individuals, households and businesses would be willing to pay for financial protection.

Risk perception and willingness-to-pay for financial protection is likely to vary among the different natural hazard perils. Individuals, households and businesses are likely to be more aware of their exposure to risks that materialise more frequently in a broad range of locations (e.g. convective storms) and therefore more willing to pay for financial protection. Individuals, households and business located in areas prone to flooding or wildfires or exposed to periodic cyclones may also have high levels of risk awareness although the broader geographic footprint of these types of events could increase the expectation of government financial assistance in response to these types of widespread risks, particularly where such assistance has been provided in the past. There might also be a perception that government is partly responsible for damages and losses in communities where development was authorised despite exposure to natural hazard risks. The willingness-to-pay for earthquake coverage is likely to be lower given the infrequency of major earthquakes.

The perception of risks related to infectious disease outbreaks is likely high in the aftermath of COVID-19 although will certainly decline if there are no other major outbreaks in the coming years. However, the willingness-to-pay for financial protection against this risk is likely very low given the substantial government financial assistance that was provided in response to the most recent pandemic. Individuals, households and businesses may also attribute some responsibility to the government for losses related to restrictions on economic activity, particularly if the restrictions are perceived to demonstrate a failure in the health care system or in the monitoring of infectious disease risks.

Risk perception and willingness-to-pay for financial protection against cyber risks may be relatively higher given the higher frequency of cyber attacks and incidents, even if cyber catastrophes occur rarely. There is likely to be a more limited expectation of government financial assistance for those impacted as past events have not usually led to government financial assistance. However, the level of expectation could be higher in the context of a cyber catastrophe, particularly if government policy or actions are perceived to have been a factor motivating the attack.

3.5. Determining the appropriate form of government-supported financial protection

Should governments identify a need for government-supported financial protection, they could offer such protection through either a public-private insurance programme or a public compensation and financial assistance arrangement. These two main approaches differ in terms of how they are funded, the level of certainty provided for beneficiaries and the level of discretion available to governments, and the potential for the participation of the private (re)insurance market in distributing financial protection and assuming risk. In determining the optimal approach for delivering government-supported financial protection, governments should assess the nature and implications of the risk exposure and the costs and benefits of (re)insurance market participation (Table 3.6).

Table 3.6. Factors that could impact the appropriate form of government-supported financial protection for natural hazard, infectious disease outbreak and cyber risks

	Benefits of reserve accumulation	Importance of certainty of financial protection	Opportunity to leverage private market capacity	Opportunity to support risk reduction through insurance
Natural hazards	Higher frequency supports reserve accumulation	Certainty of financial protection is often important for access to credit	High – significant market appetite	High – insurers have substantial risk assessment and risk reduction expertise and can provide premium incentives
Infectious disease outbreaks	Very low frequency could make reserve accumulation challenging	Certainty of financial protection is unnecessary in accessing credit	Limited – market appetite for revenue loss is likely limited	Limited – there may be few opportunities for effective risk reduction for revenue loss
Cyber attacks and incidents	Low frequency of cyber catastrophes could make reserve accumulation challenging	Certainty of financial protection is increasingly important for contractual arrangements	High – increasing market appetite	High – insurers have increasing risk assessment and risk reduction expertise and can provide premium incentives

Note: Darker blue indicates a greater potential benefit in offering government-supported financial protection through insurance and with insurance sector participation.

3.5.1. Nature and implications of the risk exposure

Governments should consider the nature of the different risks and the implications of risk exposure in deciding on the most appropriate approach to offering government-supported financial protection.

For risks that are expected to materialise more frequently, there could be a number of advantages to offering government-supported financial protection through a public-private insurance programme. In particular, the collection of premiums would provide a source of funding to address more frequent losses.

However, it would likely be more challenging to accumulate significant reserves to respond to risks that materialise with very low frequency. Allocating funds to accumulate reserves has opportunity costs, which may be deemed to be unacceptably high if there are many other unmet needs for government spending and investment. Accessing debt markets to spread at least a portion of the costs of very low frequency events over time may be preferred from a societal perspective. Large losses from natural hazards occur relatively frequently in many countries, although some types of natural hazard risks, such as earthquakes, are relatively rarer. Cyber catastrophes and major infectious disease outbreaks currently materialise with low frequency, although the frequency of both risks could increase in the future.

There may also be some longer-term implications in offering significant government-supported financial protection as public compensation and financial assistance. If that assistance is provided as grants funded by the government budget or as tax reductions or tax deferrals, a large amount of support could increase fiscal deficits and government debt-to-GDP ratios. If provided as equity, loans or guarantees, a large amount of support could lead to future fiscal costs from reductions in equity value or loan defaults. An increase in lending, including where supported by government guarantees, could lead to higher leverage in the corporate sector. As a result, public and private investment, and ultimately economic growth, could be lower if both governments and businesses have a reduced capacity to finance productive investments.33 One study of the impact of corporate leverage on investment found that higher corporate leverage can negatively impact investment for three to five years (Heresi and Powell, 2022[109]).

A reliance on borrowing to respond to the impact of COVID-19 led to increased debt levels that may be constraining productive investment. Governments provided significant financial protection through public compensation and financial assistance. Debt-to-GDP levels have increased in OECD countries and are expected to reach 85% in 2025, a 10% percentage point increase relative to 2019 and almost twice as high as 2007 (OECD, 2026[110]). Outstanding SME business loan debt in 2022 was, on average, 25% larger relative to 2019 in OECD Members with available data (OECD, 2024[111]).34 Business bankruptcies were significantly higher in 2023 in 35% of the OECD Members35 for which data was available (OECD, 2024[112]) and are expected to continue to increase in many countries (Boata, Kuhanathan and Lemerle, 2024[113]). Overall corporate debt has been increasing, including corporate bonds, syndicated loans and private credit. The outstanding amount of corporate bonds in 2025 was 64% higher than in 2008 (in real terms) and has been increasingly concentrated among issuers with lower credit ratings (OECD, 2026[110]). Corporate leverage measures such as corporate debt-to-GDP (including bonds and syndicated loans), have increased in 29 out of 38 OECD countries (OECD, 2026[110]). In addition, much of the debt issued in recent years has been driven by a desire to fund financial operations and shareholder payouts, rather than productive investments (OECD, 2025[114]).

A public-private insurance programme could provide confidence that exposures are mitigated through an obligation to provide financial protection, and therefore limit the potential for unprotected financial exposures to lead to ex ante hindrances to economic activity and/or access to credit. Unprotected financial exposure to some natural hazard risks can impact access to credit. Unprotected financial exposure to cyber risks is having an increasing impact on transactions between businesses. The financial protection provided by a public compensation or financial assistance programme, even if arranged ex ante, may not provide the level of certainty on the availability of financial protection that would be necessary to reduce the hindrances to economic activity and access to credit.

An approach to offering financial protection that provides greater government discretion in defining the response will likely have advantages where the materialisation of risk would involve greater uncertainty in terms of its potential impact. The magnitude and distribution of losses from a cyber catastrophe or a major infectious disease outbreak is more uncertain given the limited experience. A public-private insurance programme with a pre-defined public resource commitment could reduce governments’ flexibility in allocating public resources should unanticipated needs arise.

Risks that are most likely to impact households or businesses with limited financial capacity may be more difficult to address through a public-private insurance programme if potential beneficiaries are unable to afford the required contributions or premiums. Natural hazards, cyber attacks and incidents and infectious disease outbreaks all have the potential for disparate impacts on more vulnerable segments of the population. If the premium rate limits the reach of the arrangement, there could be significant unprotected financial exposures remaining among vulnerable populations.

3.6. Costs and benefits of insurance market participation

3.6.1. Leveraging (re)insurance market capacity

A public private insurance programme could allow for some of the risk to be assumed by the private (re)insurance sector and thereby reduce the damages and losses that would need to be borne by the government.

There is significant insurance market appetite for assuming natural hazard risks. Unprotected financial exposures to natural hazard risks appear to be mainly driven by challenges related to affordability and take-up, rather than availability, although there are current concerns about availability in some high-risk regions and concerns about future availability in the context of a changing climate. Currently, there is significant (re)insurance and capital market capacity and appetite for natural hazard risks and insurance markets are generally maintaining, if not increasing, their contribution to providing financial protection against these risks. Overall, insurance markets have absorbed an increasing amount of natural hazard losses and a larger share of most natural hazard losses in OECD Members and accession candidate countries,36 with some exceptions for specific types of hazards and in specific countries.37 The reinsurance market capacity to absorb natural hazard losses, in terms of catastrophe budget allocations, has increased along with the outstanding value of the catastrophe bonds and insurance-linked securities that are mostly focused on providing protection against natural hazard risks.

Unprotected financial exposures to cyber attacks and incidents appear to be driven by challenges related to take-up in the case of idiosyncratic cyber risks, although with some challenges related to availability for smaller companies and companies operating in some sectors and in terms of capacity for higher limits sought by larger companies. There are also challenges related to availability of coverage for cyber attacks and incidents with the potential to lead to cyber catastrophes such as major nation-state attacks and critical infrastructure disruptions. Insurance and reinsurance sector appetite for idiosyncratic cyber risks appears to be growing with a significant projected increase in premiums38 and some signs of higher limits being offered by insurers (Amwins, 2024[66]; Robinson, 2025[115]). There are signs of increasing reinsurance and retrocession market capacity for excess-of-loss coverage (Howden Re, 2025[98]). Efforts are also being made to address the gap in availability for some of the types of incidents that have been excluded from cyber insurance policies, including coverage for indirect damages and losses from an act of war, although with relatively low limits available (Markel, 2025[116]).

A public private insurance programme could potentially enhance the availability of private insurance market coverage if the programme is able to respond to the constraints that limit private insurance market appetite. For example, a reinsurance coverage or guarantee to protect against extreme losses could lower the amount of capital that insurance companies need to set aside to protect against such losses (Romanosky et al., 2025[29]). Such a measure could support affordability of coverage for natural hazard and cyber risks and could potentially unlock additional capacity and appetite for cyber catastrophes (Brew and Lewis, 2025[26]). A public-private insurance programme could also facilitate the implementation of a requirement to acquire insurance which could eliminate adverse selection and create a more diversified pool of risks. These types of measures could help address unprotected financial exposures due to limited take-up of insurance for natural hazard and cyber risks.

The risk-sharing benefits of a public-private insurance programme will likely be more limited for risks for which the private insurance sector has very limited capacity or appetite for assuming risk (i.e. where a significant share of risk would need to be borne by governments). The unprotected business interruption exposures related to major infectious disease outbreak are driven by a lack of availability of coverage, which also makes it impossible to evaluate challenges to affordability or take-up based on insurance market practice. The revenue and income losses resulting from COVID-19 were significantly greater than the existing financial capacity of the insurance sector (Hartwig and Gordon, 2020[95]; Schanz, 2020[96]). The potential for correlated global losses is likely a major impediment to the availability of reinsurance market capacity, while significant uncertainty in risk assessment and quantification and potential for adverse selection would likely lead to high private insurance sector premiums for even a limited amount of coverage (GAO, 2023[103]). While any risk assumed by private (re)insurance and capital markets would reduce the fiscal burden for governments, these benefits would need to be weighed against the potentially high cost of private sector coverage for risks that are challenging to insure. A decision on offering public compensation and financial assistance for this risk should, however, take into account the potential that such assistance is likely to discourage the purchase of insurance and impede the development of an insurance market.

3.6.2. Support for quicker payments and reduced fraud

Offering government-supported financial protection in collaboration with private insurance markets through a public-private insurance programme could have additional benefits. Private insurance companies may be able to provide faster payments to households and businesses that would support a quicker recovery and potentially reduce the overall level of losses. Private insurance companies might also have expertise that could better detect fraudulent claims and therefore reduce the overall cost of compensating losses.

Increasing the speed of payment

The main objective in ensuring adequate financial protection is to provide an effective source of funding to recover from the damages and losses incurred. The capacity to provide funds quickly to those in need is also of critical importance as delays in making payments to those impacted will lead to a slower recovery and a longer disruption in economic activity, which is likely to increase the overall cost of the event.

A number of factors could impact the speed at which funds are disbursed to those that have suffered a covered loss, including the time it takes for the financial protection provider to be notified of a loss and the amount of time needed to assess the loss and make payment. If payment amounts are large overall, there may also be a need to raise sufficient funds to meet the payment obligations.

There is a general perception that public compensation and financial assistance provided by governments is slower to reach beneficiaries than private insurance (Romanosky et al., 2025[29]). Government programmes might have complicated application processes that are difficult for applicants to complete and may be slower in processing the applications received. For example, a report by the Ombudsman for the Canadian province of British Columbia that examined the delivery of public compensation and financial assistance after major flooding in 2022 identified participant concerns about confusing application processes, insufficient assistance for completing the application, and delays in processing and payment (Ombudsperson British Columbia, 2023[117]). Similar concerns about application processes have also been raised in other parts of Canada as well (Schmunk, 2023[118]).

Delays in processing and payment are likely to be greater where programmes are only established and defined in the aftermath of a major event resulting in large unprotected losses, which has often been the case for public compensation and financial assistance arrangements. In the United States, the Government Accountability Office found that some of the income and revenue support programmes launched in response to COVID-19 suffered from delays due to a lack of critical programme information and confusion about eligibility (GAO, 2023[103]). A lack of sufficient human resources to process claims was identified as a challenge in responding to financial assistance requests following the floods in British Columbia (Ombudsperson British Columbia, 2023[117]), while a lack of systems capacity delayed COVID-19 response payments in the United States (GAO, 2023[103]).

There might also be limited awareness of the availability of public compensation and financial assistance and misunderstanding about eligibility. For example, the examination in British Columbia found that a majority of those that were impacted by the flooding did not make an application for assistance (64%), with the most common reason being that they were not aware of the programme (Ombudsperson British Columbia, 2023[117]). More than half of the applications were closed without any payment and appeals were filed by almost 8% of all applicants (Ombudsperson British Columbia, 2023[117]), which could indicate a lack of understanding of what kinds of damages and losses were eligible for programme compensation.

The insurance sector’s experience in responding to claims, and the existence of an insurance policy that pre-defines the applicable coverage and process for making claims, could support more efficient payments to those that have faced losses and damages. However, insurers could also face challenges if an event leads to an extreme surge in claims (GAO, 2023[103]). In the aftermath of some major natural hazards, insurers have also been criticised for payment delays and claims denials, suggesting that insurers might face similar capacity constraints and misunderstandings about coverage (House of Representatives Standing Committee on Economics, 2024[119]). Box 3.3 provides some examples of recent parliamentary investigations into insurer claims practices in Australia and the United States. Claims denials have also been found to be common in cyber insurance. According to one estimate, insurers denied 44% of cyber-related claims in 2023 and did not pay 27% of claims because of exclusions that were found to be applicable (Hoffman, 2024[50]).

Box 3.3. Parliamentary and Congressional hearings on insurer claims processing

In the United States, the Senate Committee on Homeland Security and Governmental Affairs held a hearing in May 2025 to examine the insurance sector’s claims practices in the aftermath of recent disasters, with a focus on Hurricanes Helene and Milton. The Committee heard testimony from individual policyholders and loss adjusters who suggested that claims had been denied unfairly and from policyholder representatives who worked to demonstrate a pattern of claims denials aimed at minimising losses and enhancing insurance company profitability (Dahl, 2025[120]; Quinn, 2025[121]). It also heard and received submissions from insurance companies and an insurance association that indicated that less than 1% of the claims had led to policyholder complaints (APCIA, 2025[122]).

In Australia, the House of Representatives Standing Committee on Economics undertook an inquiry into the insurance sector’s response to major flood claims in 2022. In its report, the Standing Committee highlighted inconsistencies in claims decisions and lengthy disputes. The report also highlighted a relatively low level of success for insurers in cases that reached the Australian Financial Complaints Authority (AFCA) and suggested that this might put into question the fairness of the internal dispute resolution processes that precede a referral to the AFCA (House of Representatives Standing Committee on Economics, 2024[119]).

There is mixed evidence on whether public compensation and financial assistance provide a quicker or slower response in the aftermath of an event. In British Colombia, approximately 80% of requests for financial assistance were processed within the first eleven months and more than 99% were closed within 16 months of the event (Ombudsperson British Columbia, 2023[117]). The experience in providing public compensation and financial assistance in response to COVID-19 also demonstrated that such assistance can be delivered quickly. For example, in the United States, more than 4.6 million loans allocating approximately 76% of the available funds under the Paycheck Protection Program were extended within the first three months after COVID-19 was identified as a pandemic (GAO, 2023[103]). Similarly, the U.S. Small Business Administration approved 5.8 million loan advances under the COVID-19 Economic Injury Disaster Loan in just over three months, almost three times more loans than had been approved during the agency’s 67-year pre-COVID history (GAO, 2023[103]).

Some insurance sector responses to major natural hazard events have been rapid. For example, just under 84% of Hurricane Helene and 80% of Hurricane Milton (mostly wind) claims were settled within three months (APCIA, 2025[122]). Hurricane Helene and Hurricane Milton flood claims covered by the public sector National Flood Insurance Program were settled slightly more slowly (approximately 70% of claims had been settled within 4-5 months) (APCIA, 2025[122]). In Spain, the Consorcio de Compensación de Seguros, with the support of the private insurance sector, was able to pay 95.7% of claims for damages to homes and vehicles by the 10th month after the Valencia floods in 2024. However, in Australia, more than 16% of all claims remained open after 12 months for one flooding event (House of Representatives Standing Committee on Economics, 2024[119]).

Reducing fraud and overpayment

There will always be some risk of fraudulent or overpayments when distributing funds, whether through a public-private insurance programme or as public compensation and financial assistance.

Fraudulent claims are a significant cost for private insurance companies and their policyholders. According to one estimate, approximately 20% of all insurance claims in the United States are fraudulent, with an annual cost of USD 308.6 billion (Kilroy, 2025[123]). In the property and casualty insurance sector, the share of fraudulent claims is slightly lower, approximately 10%, costing USD 122 billion annually (Kamalapurkar, Sharma and Canaan, 2025[124]). Large-scale events often attract fraudulent insurance claims and requests for government assistance (Kilroy, 2025[123]).

Public compensation and financial assistance provided by governments after major events is also prone to fraud. A report by the Office of Inspector General of the U.S. Small Business Administration found that at least 17% of the USD 1.2 trillion in Economic Injury Disaster Loan and Paycheck Protection Program funds were disbursed to “potentially fraudulent actors” (Office of Inspector General, 2023[125]). In the United Kingdom, approximately GBP 4.5 billion of funding provided through the Coronavirus Job Retention Scheme, the Self Employed Income Support Scheme and the Eat Out To Help Out programme was lost to fraud (Nevett, 2023[126]), out of the approximately GBP 99 billion provided through these programmes (i.e. approximately 4.5% of provided funds were lost to fraud) (Francis-Devine, Powell and Clark, 2021[127]; Evaluation Task Force, 2024[128]; Cuffe, 2023[129]). In Canada, approximately 7% of the CAD 49.1 billion funds provided under the Canada Emergency Business Account were found to have been disbursed to ineligible applicants (Office of the Auditor General of Canada, 2024[130]).

According to one estimate, insurance companies are able to detect between 20% and 40% of more common “soft fraud”, such as intentional overstatement of costs in claims, and between 40% and 80% of “hard fraud”, such as the creation of fake claims (Kamalapurkar, Sharma and Canaan, 2025[124]). Insurer investments in leveraging artificial intelligence for fraud detection could reduce overall costs of fraud by an estimated 20-40% (Kamalapurkar, Sharma and Canaan, 2025[124]). By comparison, the Office of the Auditor-General of Canada found that the vast majority (99%) of the ineligible applicants under one stream of the Canada Emergency Business Account programme were not identified by the programme administrator, although almost 100% of the ineligible applicants under the other programme stream were identified by the administrator (Office of the Auditor General of Canada, 2024[130]).39

3.6.3. Potential contribution to risk management and reduction

Offering government-supported financial protection through a public-private insurance programme, instead of through public compensation and financial assistance, could leverage private (re)insurance market expertise in risk assessment and incorporate risk-based pricing to incentivise risk reduction by individuals, households and businesses.

Enhancing risk understanding and providing advice on risk management and reduction

The (re)insurance sector has developed risk assessment tools, particularly catastrophe models, to address the gaps in historical data that hinder its ability to assess and quantify low-frequency risks. The development of risk assessment tools such as catastrophe models for specific risks or perils is positively correlated with the level of private insurance coverage for that risk or peril. As a result, forms of government-supported financial protection that involve the private (re)insurance sector in assuming risk, such as public-private insurance programmes, should support the development of risk assessment tools.

However, there are inherent challenges in modelling some risks. The development of risk assessment tools and models is most advanced for natural hazard risks although important gaps in model coverage for many countries and natural hazard perils remain. A number of models have been developed for cyber risks although there remains significant variability in modelling outputs for cyber catastrophes. Modelling of the business disruption losses linked to infectious disease outbreaks is much more limited.

These risk assessment tools can be used to provide risk signals and advice to individuals, households, businesses and governments on effective investment in risk reduction and preparedness. Insurance sector risk assessment tools are being used to support public risk awareness and to provide advice to individuals, households, businesses and governments on risk management (AXA, 2024[131]; Allianz Commercial, 2024[105]). 40 Businesses expect insurance companies to be a source of knowledge on risks, risk prevention and building resilience and do receive, and appreciate, advice from insurers and intermediaries on risk reduction (AXA, 2024[131]).

For natural hazard risks, there are many examples of insurance company efforts to provide risk information and risk reduction advice to corporate policyholders (OECD, 2023[101]). 41 However, the sharing of insurance sector expertise with the smaller businesses and households that would likely benefit the most from insurance sector advice on risks and risk management may be more limited. There is some evidence that such information is not being provided, received and acted upon (OECD, 2023[101]). For example, one survey of non-life insurers in Europe found that only 25% of the responding insurers provided climate-related information to policyholders and only some provided specific information on practical risk reduction measures that policyholders could take (EIOPA, 2023[132]). It is likely more challenging for insurers and intermediaries to provide tailored advice to smaller companies and households as the amount of premiums involved are not sufficient to cover the costs of individualised risk assessment and advice (OECD, 2023[101]). Some insurance sector representatives have indicated that, in cases where the premium is not sufficient to cover the costs of individual risk assessment and advice, insurers and intermediaries may try to find ways to provide these services. 

In the case of cyber risks, insurers and intermediaries appear to be providing significant advice on risk reduction as well as services aimed at reducing ex ante risk and ex post costs. Cyber insurers have been providing a broad range of risk assessment, risk mitigation and incident response services as part of their insurance offering to companies of all sizes (OECD, 2017[133]). The service offering has continued to expand to include employee training, penetration testing, dark web monitoring and even specific detection and response tools (Gupta, 2025[134]; Robinson, 2025[115]). One survey of SMEs found that those with cyber insurance coverage had significantly greater access to critical cyber security prevention and response capacities, such as incident response teams, intrusion detection and prevention systems, and forensic analysis (Howden, 2025[67]).

The insurance sector is also investing in analysing the effectiveness of different cyber security measures. For example, one insurance intermediary has been comparing data from its clients on implemented cyber security measures with claims experience for the purpose of identifying which measures have been the most effective in reducing losses (Marsh, 2025[135]). One recent survey found increasing trust in the services provided and recognition of their value for risk reduction (Marsh, 2025[136]).

Encouraging risk reduction through risk-based premiums and coverage restrictions

The application of risk-based premiums can encourage investment in risk reduction by individuals, households and businesses. If investments in risk reduction are recognised through sufficient reductions in premium rates, the ultimate cost of investing in such measures will be reduced, which should encourage greater risk reduction investment.

There are many examples of insurance companies offering premium discounts for measures that reduce the risk of natural hazards (OECD, 2023[101]).42 However, insurers do not consistently offer premium discounts (EIOPA, 2021[137]) and households are not often aware of the available premium discounts (Hanger et al., 2018[138]). A number of examinations have found limited evidence that risk-based pricing of natural hazard insurance coverage has had a demonstrable impact on incentivising household risk reduction (OECD, 2023[101]). The limited impact on risk reduction investment may be driven by a number of potential impediments including a limited willingness or capacity of households to invest in risk reduction, few effective risk reduction options at the property-level, insurer concerns about the effectiveness of some measures, as well as the overall costs and benefits of substantial investments for all but those at highest risk (OECD, 2023[101]).

A key missed opportunity could be the limited insurance sector support for resilient reinstatement. Most residential and commercial property insurance coverage only requires insurance companies to reinstate damaged property to the same, or a materially equivalent condition as prior to incurring the loss (Rosenfield, 2022[139]). Cash settlements can provide an opportunity to build back better or to rebuild in a less risky location although the negotiation of cash settlements could create risks for consumers and some insurers may discourage cash settlements (Senate Select Committee on the Impact of Climate Risk on Insurance Premiums and Availability, 2024[140]).

Insurers appear to be applying risk-based premiums and often set risk management conditions when providing cyber insurance coverage. For larger companies, insurers will often undertake comprehensive security assessments involving detailed questionnaires, site visits and hardware examinations before extending coverage. While cyber risk assessments appear to be more limited for smaller companies, the increasing availability of technological and third party solutions for risk assessment is likely to support improvements in the capacity of insurers to support cyber resilience (Mauro and Grossman, 2025[141]).

The potential for incentivising risk reduction is likely more limited in the case of infectious disease outbreaks. There are few steps that a business can take to reduce revenue losses in the context of a required closure, particularly in sectors where revenue depends on consumer interaction (GAO, 2023[103]).

3.7. Conclusion

Unprotected financial exposures to large-scale risks could have important social, economic and financial implications and create financial vulnerabilities for those impacted. Governments play an important role in ensuring that adequate financial protection, whether through insurance or other forms, is available to respond to these financial vulnerabilities.

This chapter applied the framework for considering government-supported financial protection from Chapter 2 to three large-scale risks. Natural hazards, cyber attacks and incidents and infectious disease outbreaks all have the potential to result in material impacts for a significant share of the population. There are gaps in the adequacy of financial protection for these risks that can lead to unprotected financial exposures. For natural hazard risks, the gaps are driven by challenges related to affordability for some households and businesses and a lack of take-up. For cyber attacks and incidents, the gaps result from some gaps in the adequacy of limits, limited take-up as well as the application of exclusions aimed at protecting insurers from large correlated losses. For infectious disease outbreaks, the availability of coverage for business revenue losses is extremely limited.

Governments should consider various factors when evaluating whether to address these gaps through an offer of government-supported financial protection. These factors include the likelihood, frequency and severity of the risk, potential implications for economic activity, such as access to credit, and the distribution of potential losses, including the possibility that vulnerable segments of the population will be particularly impacted. This evaluation should also consider the potential for expanding the availability, affordability and take-up of financial protection through private insurance markets.

The rationale for offering some form of government-supported financial protection is likely to be higher for the natural hazard risks that occur with greater frequency and are more likely to affect access to credit. However, in some cases, unprotected financial exposures are driven almost exclusively by gaps in take-up of available and affordable coverage which may be better addressed through other policy and regulatory interventions such as investments in risk reduction and efforts to improve risk awareness. There may also be a rationale for offering government-supported financial protection for cyber risks given the increasing impact of unprotected cyber exposures on contractual relationships and the potential that government support could mitigate a substantial impediment to the availability of insurance coverage.

If a decision is taken to offer government-supported protection, governments should consider the nature and implications of the unprotected financial exposures and the potential contribution of private (re)insurance market participation. Public-private insurance programmes might be more appropriate for addressing risks that would lead to more frequent funding demands, where certainty of financial protection is necessary for those exposed, and where the insurance sector can potentially contribute to assuming losses, making speedy payments, reducing fraud and encouraging risk management and risk reduction.

The insurance sector has greater appetite and capacity to assume natural hazard and cyber risks and there is some evidence that the sector contributes to natural hazard and cyber risk reduction. However, that contribution appears to be more limited for households and smaller businesses. Insurance markets and reinsurance markets have more limited appetite for providing coverage for the revenue losses related to major infectious disease outbreaks and their ability to incentivise risk reduction is likely to be more limited.

References

[161] Allianz Commercial (2025), Allianz Risk Barometer: Identifying the major business risks for 2025, Allianz.

[105] Allianz Commercial (2024), Allianz Risk Barometer: Identifying the major business risks for 2024, Allianz.

[93] Altman, W. (2025), Global Threat Briefing (H1 2025): Understanding cyber risks for small businesses., CyberCube.

[66] Amwins (2024), State of the Market: 2025 Outlook, Amwins.

[83] Aon (2025), A Highlight Year For Systemic Risk – And Single Point Of Failure Events, Aon.

[122] APCIA (2025), Statement of the American Property Casualty Insurance Association: “Examining the Insurance Industry’s Claims Practices Following Recent Natural Disasters”.

[154] Artemis (n.d.), Catastrophe bonds & ILS issued and outstanding by year, Artemis.

[99] Artemis (n.d.), Catastrophe bonds & ILS outstanding by risk or peril, Artemis.

[73] ASF (2024), Relatório de Estabilidade Financeira do Setor Segurador e dos Fundos de Pensões - dezembro 2023, Autoridade de Supervisão de Seguros e Fundos de Pensões.

[90] Asl, S. et al. (2025), “Social vulnerability correlates of flood risk to crops and buildings”, Natural Hazards, Vol. 121/7, pp. 8137-8158, https://doi.org/10.1007/s11069-025-07137-y.

[10] Atradius (2025), Atradius Insolvency Outlook: Insolvencies normalise, but trade war brings new risks, Atradius.

[11] Australian Signals Directorate (2024), Annual Cyber Threat Report 2023-2024, Australian Government.

[160] AXA (2025), AXA Future Risks Report 2025, AXA.

[131] AXA (2024), AXA Future Risks Report 2024, AXA.

[15] Azimi, M. (2024), Small business owners: Do you know the full cost of a cyber attack?, Insurance Bureau of Canada.

[152] Bhojani, S. (2024), Reinsurers Show Growing Appetite For Natural Catastrophe Risks, S&P Global.

[163] Bhojani, S. et al. (2025), Reinsurers’ Catastrophe Appetite Stabilizes Amid Declining Prices, S&P Global.

[84] Blickle, K. et al. (2023), How Do Banks Lend in Inaccurate Flood Zones in the Fed’s Second District?, Federal Reserve Bank of New York.

[108] Blosfield, E. (2025), “Diversification, Risk Modeling Top of Mind for Carriers as Cyber Market Softens”, Carrier Management.

[113] Boata, A., A. Kuhanathan and M. Lemerle (2024), Global Insolvency Outlook: The ebb and flow of the insolvency wave, Allianz.

[26] Brew, O. and B. Lewis (2025), Cyber Risk Pools and Public Private Partnerships – Time to dive in?, Lockton Re.

[75] Bueermann. Gretchen and M. Rohrs (2024), Global Cybersecurity Outlook 2024, World Economic Forum.

[104] Caron, P. (2025), “Understanding costs, impacts, and the future of risk modeling”, PropertyCasualty360.

[144] Centre for Research on the Epidemiology of Disasters (CRED) (n.d.), EM-DAT.

[57] CIR (2025), “AWS outage could cost US businesses up to £560m – Parametrix”, Continuity Insurance and Risk.

[17] CIR (2024), “Over a third of cyber attacks result in job losses – report”, Continuity Insurance and Risk.

[58] Collins, S. (2024), “Nation states hiding behind cyber criminals to sow chaos, warns CyberCube”, Commercial Risk.

[143] Cordonnier, A. and E. Davis (2023), Through the looking glass: Interrogating the key numbers behind today’s cyber market, Guy Carpenter.

[129] Cuffe, R. (2023), “Eat Out to Help Out: What was the impact of the scheme?”, BBC.

[47] Curtis, H. (2022), Covid-19’s lasting impact on cover for other diseases, Insurance Post.

[142] Cyentia (2025), Information Risk Insight Study 2025: It’s About Time!, Cyentia.

[120] Dahl, C. (2025), “Senate subcommittee grills insurance execs”, PropertyCasualty360.

[65] Davis, M. (2025), State of Home Insurance: 2025, LendingTree.

[40] Deloitte Access Economics (2016), “The cost of natural disasters: Australian experiences”, in The economic cost of the social impact of natural disasters, Australian Business Roundtable for Disaster Resilience & Safer Communities.

[155] Demmou, L. et al. (2021), “Insolvency and debt overhang following the COVID-19 outbreak: Assessment of risks and policy responses”, OECD Economics Department Working Papers, No. 1651, OECD Publishing, Paris, https://doi.org/10.1787/747a8226-en.

[46] Dennis, H. (2024), Communicable diseases, Aon.

[18] Dilley, M. et al. (2005), Natural Disaster Hotspots: A Global Risk Analysis, World Bank and Columbia University.

[71] EIOPA (2025), Dashboard on insurance protection gap for natural catastrophes, European Insurance and Occupational Pensions Authority, https://www.eiopa.europa.eu/tools-and-data/dashboard-insurance-protection-gap-natural-catastrophes_en.

[162] EIOPA (2025), Technical Description - Dashboard on Insurance Protection Gap for Natural Catastrophes, European Insurance and Occupational Pensions Authority.

[132] EIOPA (2023), Impact underwriting: Report on the Implementation of Climate-Related Adaptation Measures in Non-Life Underwriting Practices, European Insurance and Occupational Pensions Authority, https://www.eiopa.europa.eu/document-library/report/impact-underwriting-report-implementation-of-climate-related-adaptation_en (accessed on 10 February 2023).

[137] EIOPA (2021), Report on non-life underwriting and pricing in light of climate change, European Insurance and Occupational Pensions Authority.

[159] Elsner, M., G. Atkinson and S. Zahidi (2025), Global Risks Report 2025, World Economic Forum.

[56] Essen, Y. (2025), CyberCube States AWS Outage Highlights Systemic Risk from Cloud Concentration, CyberCube.

[128] Evaluation Task Force (2024), The Self-Employment Income Support Scheme (SEISS) final evaluation July 2023, Government of the United Kingdom.

[148] Fearnhead, R. and J. Stubing (2025), Closed lists in COVID-19 business interruption claims, Mishcon de Raya.

[43] Federal Insurance Office (2025), Analyses of U.S. Homeowners Insurance Markets, 2018-2022: Climate-Related Risks and Other Factors, U.S. Department of the Treasury.

[49] FERMA (2024), Global Risk Manager Survey Report 2024, Federation of European Risk Management Associations.

[151] First Street (2025), The 13th National Risk Assessment: Climate, the Sixth “C” of Credit, First Street.

[63] FM (2025), Ready for the storm: closing the extreme weather resilience gap, Factory Mutual Insurance Company.

[91] Foran, H., M. Sinha and L. Pinault (2025), The intersection of flooding and deprivation: A study of neighbourhoods, Statistics Canada: Insights on Canadian Society.

[127] Francis-Devine, B., A. Powell and H. Clark (2021), Coronavirus Job Retention Scheme: statistics, House of Commons Library.

[103] GAO (2023), Pandemic Risk: Federal Insurance Approaches Would Entail Costs to Taxpayers and Businesses Might Not Participate, Government Accountability Office.

[37] GAO (2020), Natural Disasters: Economic Effects of Hurricanes Katrina, Sandy, Harvey, and Irma, Government Accountability Office.

[52] GFIA (2023), “Cyber protection gap”, in Global protection gaps and recommendations for bridging them, Global Federation of Insurance Associations.

[44] Golnaraghi, M. and Z. Vichev (2025), Safeguarding Home Insurance: Reducing exposure and vulnerability to extreme weather, The Geneva Association.

[78] Grimm, T. and L. Hanselmann (2025), How catastrophes limit prosperity – weather disasters are a growing burden, also for many industrialised countries, Munich Re.

[42] Guasch Garcia, I. and M. Pujol (2025), Top 10 Cyber Incidents 2024, Tokio Marine HCC.

[134] Gupta, R. (2025), “Why Cyber Insurers Should Partner in Cybersecurity Support”, Insurance Journal.

[53] Guy Carpenter (2025), Behind the Firewall: 2024 Global Cyber Industry Insights, Guy Carpenter.

[138] Hanger, S. et al. (2018), “Insurance, Public Assistance, and Household Flood Risk Reduction: A Comparative Study of Austria, England, and Romania”, Risk Analysis, Vol. 38/4, pp. 680-693, https://doi.org/10.1111/RISA.12881.

[2] Harris, A. (2022), Preparing your property and having a plan before a wildfire strikes can help reduce damage, State Farm.

[95] Hartwig, R. and R. Gordon (2020), Uninsurability of Mass Market Business Continuity Risks from Viral Pandemics, American Property Casualty Insurance Association, http://www.pciaa.net/docs/default-source/default-document-library/apcia-white-paper-hartwig-gordon.pdf.

[72] Hellenic Association of Insurance Companies (2025), Number of House Insurance contracts: Survey of 30/06/2025, Hellenic Association of Insurance Companies.

[54] Hemenway, C. (2025), “CyberCube: Insured Loss Estimate From AWS Outage Likely About $40M”, Insurance Journal.

[109] Heresi, R. and A. Powell (2022), “Corporate Debt and Investment in the Post-Covid World”, IDB Working Paper Series, No. IDB-WP-1316, Inter-American Development Bank, Washington, D. C., https://doi.org/10.18235/0004464.

[76] Hiscox (2025), Cyber Readiness Report 2025, Hiscox.

[24] Hiscox (2024), Cyber Readiness Report 2024, Hiscox.

[16] Hiscox (2022), Cyber Readiness Report 2022, Hiscox.

[50] Hoffman, Z. (2024), Cyber Insurance Challenges: Why Premiums Are Rising, and Coverage Is Harder to Obtain, CyberMaxx.

[119] House of Representatives Standing Committee on Economics (2024), Flood failure to future fairness: Report on the inquiry into insurers’ responses to 2022 major floods claims, Parliament of Australia.

[67] Howden (2025), Cyber Insurance: Rebooting growth, Howden Re.

[34] Howden (2024), Cyber insurance: Risk, resilience and relevance, Howden Group.

[107] Howden (2024), Cyber insurance: Risk, resilience and relevance, Howden Group.

[98] Howden Re (2025), Into the Cyberverse, Howden Re.

[13] Insurance Information Institute and HSB (2025), Addressing the Personal Cyber Protection Gap.

[12] Internet Crime Complaint Center (2025), Internet Crime Report 2024, Federal Bureau of Investigation.

[33] Johansmeyer, T. (2024), Recent cyber catastrophes show an intensifying trend – but they are manageable, The Loop: ECPR’s Political Science Blog.

[32] Johansmeyer, T. (2024), Surprising stats: the worst economic losses from cyber catastrophes, The Loop: ECPR’s Political Science Blog.

[36] Kajitani, Y., S. Chang and H. Tatano (2013), “Economic Impacts of the 2011 Tohoku-oki earthquake and tsunami”, Earthquake Spectra, Vol. 29/SUPPL.1, https://doi.org/10.1193/1.4000108/ASSET/IMAGES/LARGE/10.1193_1.4000108-FIG11.JPEG.

[124] Kamalapurkar, K., N. Sharma and M. Canaan (2025), Property and casualty carriers can win the fight against insurance fraud, Deloitte.

[123] Kilroy, A. (2025), “Insurance Fraud Statistics 2025”, Forbes.

[80] Kraut, G., P. La Bonté and A. Richter (2025), “Pandemic Risk Management and Insurance”, in Handbook of Insurance, Springer Nature Switzerland, Cham, https://doi.org/10.1007/978-3-031-69561-2_9.

[31] Lloyd’s Futureset and Cambridge Centre for Risk Studies (n.d.), Illuminating cyber crime - Systemic risk scenario: Major cyber attack.

[27] Lloyd’s Market Association (2025), Scoping out systemic cyber risk: A framework for assessing the aggregation potential of ‘other cyber’ scenarios, Lloyd’s Market Association.

[30] Lloyd’s and AIR Worldwide (2018), Cloud Down: Impacts on the US economy, Lloyd’s, http://www.lloyds.com/cloud (accessed on 9 November 2020).

[77] Lutz, V., C. Lafakis and K. Rudaviciute (2025), Catastrophic events in an uncertain future: A pending $41 trillion bill for businesses and governments to resolve, Moody’s.

[79] Madhav, N. et al. (2023), “Estimated Future Mortality from Pathogens of Epidemic and Pandemic Potential”, CGD Working Paper, No. 665, Center for Global Development.

[116] Markel (2025), Markel launches first-of-its-kind affirmative cyber product for collateral war cover, PR Newswire.

[135] Marsh (2025), Cybersecurity signals: Connecting controls and incident outcomes, Marsh.

[136] Marsh (2025), The evolution of cyber claims in Europe: Marsh European cyber claims report, Marsh.

[45] Marsh (2021), Communicable Disease Exclusion Clauses, Marsh McLennan.

[141] Mauro, S. and T. Grossman (2025), Enhancing Cyber Resilience through Insurance: Revisiting Anti-Bundling Regulation, The Institute for Security and Technology.

[92] McGowan, V. and C. Bambra (2022), “COVID-19 mortality and deprivation: pandemic, syndemic, and endemic health inequalities”, The Lancet Public Health, Vol. 7/11, pp. e966-e975, https://doi.org/10.1016/S2468-2667(22)00223-7.

[55] Miller, J. (2023), War exclusions in cyber policies: an overview, DAC Beachcroft.

[60] Muncaster, P. (2025), The state of information security report 2025, Alliantist.

[23] Munich Re (2024), Munich Re Global Cyber Risk and Insurance Survey 2024: Bridging the gap in cyber protection, Munich Re.

[149] Munich Re (n.d.), Epidemic and pandemic risk solutions, Munich Re.

[147] NAIC (2024), What Are Earthquake Deductibles?, National Association of Insurance Commissioners.

[25] National Cyber Security Centre (2025), UK experiencing four ’nationally significant’ cyber attacks every week, National Cyber Security Centre.

[1] National Flood Insurance Program (n.d.), Floodsmart: Protect the life you’ve built, U.S. Department of Homeland Security.

[14] NetDiligence (2024), Cyber Claims Study: 2024 Report, NetDiligence.

[126] Nevett, J. (2023), “Covid-19 support worth £4.5bn lost to error and fraud”, BBC.

[89] Ng, K. (2025), Minority Homeowners Face Disproportionate Climate Risks That Could Exacerbate Inequality, Zillow.

[110] OECD (2026), OECD Global Debt Report 2026: Sustaining Debt Market Resilience under Growing Pressure, OECD Publishing, Paris, https://doi.org/10.1787/e9d80efd-en.

[114] OECD (2025), Global Debt Report 2025: Financing Growth in a Challenging Debt Market Environment, OECD Publishing, Paris, https://doi.org/10.1787/8ee42b13-en.

[112] OECD (2024), Business bankruptcies (indicator), https://data-explorer.oecd.org/s/3wn.

[64] OECD (2024), Global Insurance Market Trends 2024, OECD Publishing, Paris, https://doi.org/10.1787/5b740371-en.

[111] OECD (2024), Outstanding Business Loans (SMEs) (indicator), OECD Publishing, Paris, https://data-explorer.oecd.org/s/3wo.

[101] OECD (2023), “Enhancing the insurance sector’s contribution to climate adaptation”, Business and Finance Policy Papers, Vol. 26, https://doi.org/10.1787/0951dfcd-en.

[48] OECD (2021), Enhancing Financial Protection Against Catastrophe Risks: The Role of Catastrophe Risk Insurance Programmes, OECD Publishing, Paris, https://doi.org/10.1787/338ba23d-en.

[6] OECD (2021), OECD Economic Outlook, Volume 2021 Issue 2, OECD Publishing, Paris, https://doi.org/10.1787/66c5ac2c-en.

[7] OECD (2021), OECD Employment Outlook 2021: Navigating the COVID-19 Crisis and Recovery, OECD Publishing, Paris, https://doi.org/10.1787/5a700c4b-en.

[97] OECD (2021), “Responding to the COVID-19 and pandemic protection gap in insurance”, OECD Policy Responses to Coronavirus (COVID-19), https://doi.org/10.1787/35e74736-en.

[164] OECD (2020), Encouraging Clarity in Cyber Insurance Coverage: The role of public policy and regulation, OECD Publishing, Paris, https://doi.org/10.1787/40beab07-en.

[133] OECD (2017), Enhancing the Role of Insurance in Cyber Risk Management, OECD Publishing, Paris, https://doi.org/10.1787/9789264282148-en.

[125] Office of Inspector General (2023), COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, U.S. Small Business Administration.

[130] Office of the Auditor General of Canada (2024), COVID-19 Pandemic - Report 8: Canada Emergency Business Account, Office of the Auditor General of Canada.

[117] Ombudsperson British Columbia (2023), Fairness in a Changing Climate: Ensuring disaster supports are accessible, equitable and adaptable, Ombudsperson British Columbia.

[62] Paddam, S. et al. (2024), Home Insurance Affordability and Home Loans at Risk, Actuaries Institute.

[28] Pain, D. (2023), Cyber risk accumulation: fully tackling the insurability challenge, The Geneva Association.

[74] Persano Adorno, P. (2025), Legislative and financial innovation tools for reducing the insurance protection gap for natural catastrophes in Italy.

[8] Pinkovetskaia, I. (2022), “Impact of Covid-19 pandemic on household income: results of a survey of the economically active population”, Studia Universitatis „Vasile Goldis” Arad – Economics Series, Vol. 32/1, pp. 43-57, https://doi.org/10.2478/sues-2022-0003.

[21] Piret, J. and G. Boivin (2021), “Pandemics Throughout History”, Frontiers in Microbiology, Vol. 11.

[39] Potter, S. et al. (2015), “An overview of the impacts of the 2010-2011 Canterbury earthquakes”, International Journal of Disaster Risk Reduction, Vol. 14, pp. 6-14, https://doi.org/10.1016/J.IJDRR.2015.01.014.

[121] Quinn, D. (2025), Testimony - Doug Quinn, American Policyholder Association: “Examining the Insurance Industry’s Claims Practices Following Recent Natural Disasters.

[3] Ratcliffe, C. et al. (2019), Insult to Injury: Natural Disasters and Residents’ Financial Health, Urban Institute.

[19] Rentschler, J., M. Salhab and B. Jafino (2022), “Flood exposure and poverty in 188 countries”, Nature Communications 2022 13:1, Vol. 13/1, pp. 1-11, https://doi.org/10.1038/s41467-022-30727-4.

[41] Reserve Bank of Australia (2011), Statement on Monetary Policy, Reserve Bank of Australia.

[61] Reynolds, J. (2025), “Russia could be behind cyber attacks on British businesses like M&S, Nato general warns”, Independent.

[115] Robinson, S. (2025), 2025 Q1 Cyber Market Update, Risk Placement Services.

[29] Romanosky, S. et al. (2025), Insuring Catastrophic Cyber Risk, RAND Corporation.

[139] Rosenfield, A. (2022), Reinstatement 101 – (rein)stating the obvious?, Fenchurch Law, https://www.fenchurchlaw.co.uk/reinstatement-101-reinstating-the-obvious/ (accessed on 9 June 2022).

[87] Rossiter, W. and S. Albers (2025), Structured Finance Physical Climate Risk: Discussion Paper - Request for Market Feedback on Assessing Climate Risk inResidential and Commercial Mortgage-Backed Securities and Covered Bond Ratings.

[51] Ruiz, E. (2023), Navigating common exclusions in cyber policies, ReedSmith Perspectives.

[153] S&P Global Ratings (2019), Global Reinsurance Highlights 2020, S&P Global Ratings.

[96] Schanz, K. (2020), An Investigation into the Insurability of Pandemic Risk, The Geneva Association, https://www.genevaassociation.org/research-topics/socio-economic-resilience/investigation-insurability-pandemic-risk-research-report (accessed on 14 November 2020).

[70] Schlichter, S. (2023), Personal Cyber Insurance: A Complete Guide, nerdwallet.

[118] Schmunk, R. (2023), “Sluggish, confusing disaster relief programs aren’t just a B.C. problem, experts say”, CBC.

[5] Scott, R. (2014), “Will Your Business Recover From Disaster?”, Forbes.

[158] Seifert-Dähnn, I. (2018), “Insurance engagement in flood risk reduction - Examples from household and business insurance in developed countries”, Natural Hazards and Earth System Sciences, Vol. 18/9, pp. 2409-2429, https://doi.org/10.5194/NHESS-18-2409-2018.

[140] Senate Select Committee on the Impact of Climate Risk on Insurance Premiums and Availability (2024), Impact of Climate Risk on Insurance Premiums and Availability, Commonwealth of Australia.

[4] SGS Economics and Planning (2021), The backbone of regional and rural economies: Small business and community resilience, IAG.

[86] Shankleman, J. (2024), “UK’s Second Biggest Mortgage Lender Pulls Offers Over Flood Risk”, Insurance Journal.

[156] Shiltagh, M. and C. Meley (2025), “Cyber Attack Surge Creates Opportunity for Insurers, Prompts Rethink on Premiums”, Carrier Management.

[85] Shingler, B. (2024), “A Quebec lender opted out of mortgages in flood zones. Experts warn it could happen elsewhere”, CBC News.

[157] Smart Home America (n.d.), List of Mitigation Insurance Discounts and Tax Savings, Smart Home America, https://www.smarthomeamerica.org/fortified/discounts-and-incentives/list-of-fortified-discounts-and-incentives (accessed on 13 June 2022).

[102] Sousounis, P. and H. Little (2017), Climate Change Impacts on Extreme Weather, AIR Worldwide Corporation.

[22] Statista (2024), Share of global companies encountering cyberattacks 2021-2023, by type, Statista.

[9] Statistics Canada (2020), Business revenue from April 2020 compared with April 2019, by business characteristics (Table 33-10-0253-01), Statistics Canada, https://www150.statcan.gc.ca/t1/tbl1/en/tv.action?pid=3310025301 (accessed on 6 November 2020).

[68] Swiss Re (2025), Shifting cyber insurance growth into the next gear, Swiss Re.

[69] The Council (2025), Market Index Q3 2025: Commercial Property/Casualty, The Council.

[81] The Vaccine Alliance (Gavi) (2020), 5 reasons why pandemics like COVID-19 are becoming more likely, The Vaccine Alliance (Gavi), https://www.gavi.org/vaccineswork/5-reasons-why-pandemics-like-covid-19-are-becoming-more-likely (accessed on 15 November 2020).

[88] Torarp, V. et al. (2025), When insurance becomes unaffordable, PwC.

[94] VikingCloud (2025), VikingCloud’s 2025 SMB Threat Landscape Report: Small and Medium-Sized Businesses, Big Cybersecurity Risks, VikingCloud.

[106] von dem Knesebeck, A. and M. Kreuzer (2024), Cyber Insurance: Risks and Trends 2024, Munich Re.

[150] von dem Knesebeck, A. and M. Kreuzer (2024), Global Cyber Risk and Insurance Survey 2024: Personal Lines, Munich Re.

[59] WEF (2024), The Global Risks Report 2024, World Economic Forum.

[82] Whiting, K. (2020), COVID-19 and global epidemics are becoming more frequent. This is why, World Economic Forum, https://www.weforum.org/agenda/2020/03/coronavirus-global-epidemics-health-pandemic-covid-19/ (accessed on 15 November 2020).

[20] WHO (2024), WHO COVID-19 dashboard, World Health Organization.

[146] WHO (2022), 14.9 million excess deaths associated with the COVID-19 pandemic in 2020 and 2021, World Health Organization.

[100] Willard, J. (2025), PoleStar Re 2026-1 cyber cat bond signals Beazley’s expanding growth in cyber ILS: Bantick, Artemis.

[35] Wolfrom, L. (2022), “Could insurance provide an alternative to fiscal support in crisis response?”, OECD Working Papers on Fiscal Federalism, Vol. 40, https://www.oecd.org/publications/could-insurance-provide-an-alternative-to-fiscal-support-in-crisis-response-4b3dd441-en.htm (accessed on 4 October 2022).

[38] World Bank (2012), Thai Flood 2011: Rapid Assessment for Resilient Recovery and Reconstruction Planning (Overview), World Bank.

[145] World Bank (n.d.), Population, total.

Notes

← 1.  These main categories have been identified based on surveys of leaders and risk experts aimed at identifying the most significant risks to the economy and society, including: (i) World Economic Forum Global Risks Report, which focuses on global risks to economies and societies and is based on global surveys of leaders from across the public, private and academic sectors (Elsner, Atkinson and Zahidi, 2025[159]); (ii) AXA Future Risks Report, which focuses on risks to society and is based on a survey of global experts and individuals (AXA, 2025[160]); (iii) Allianz Risk Barometer, which focuses on risks to businesses and is based on a survey of global risk management experts (Allianz Commercial, 2025[161]); and (iv) FERMA’s Global Risk Manager Survey, which focuses on risks to businesses and is based on a survey of global risk managers (FERMA, 2024[49]). While there is some variation in ranking and classification, there is a general level of consistency among these various reports in terms of this set of identified risks. Some other risks were commonly identified, including geopolitical and social tensions, critical infrastructure and supply chain disruptions, risks related to nature, ecosystems and biodiversity and risks related to pollution and harmful substances (including Per- and polyfluoroalkyl substances or PFAS) as well as risks related to demographic changes, ageing and critical illnesses and risks related to economic crises and financial stability. These other risks were not included in the analysis for a variety of reasons related to the nature of the risk and potential impacts and the availability of data on impacts, insurance coverage and other information necessary for this analysis.

← 2.  OECD calculations based on data from (Centre for Research on the Epidemiology of Disasters (CRED), n.d.[144]) on total affected population estimates from all types of natural hazards and total population estimates from (World Bank, n.d.[145]). The average total population affected was more than 1% of the total population in Brazil, Chile, Costa Rica, Czechia, Israel, Slovenia, Thailand, Türkiye and the United States. The total affected population since 2010 (overall) accounted for more than 5% of the population in these countries as well as Colombia, Croatia, Indonesia, Mexico, New Zealand and Peru. OECD Members and accession candidate countries are: Argentina, Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Chile. Colombia, Costa Rica, Croatia, Czechia, Denmark, Estonia, Finland, France, Germany, Greece. Hungary, Iceland, Indonesia, Ireland, Israel, Italy, Japan, Korea, Latvia, Lithuania, Luxembourg, Mexico, the Netherlands, New Zealand, Norway, Peru, Poland, Portugal, Romania, the Slovak Republic, Slovenia, Spain, Sweden, Switzerland, Thailand, Türkiye, the United Kingdom and the United States.

← 3.  The number of deaths is significantly higher if measures based on excess deaths, equivalent to approximately 0.19% of the global population (WHO, 2022[146]).

← 4.  EIOPA assessed the availability of coverage for households as low for flood risk in Estonia and Lithuania, coastal flood risk in Germany and Lithuania, earthquake risk in Poland (although earthquake risk is low in Poland and mostly related to mining operations, which limits the demand and supply of coverage) and wildfire risk in Portugal (EIOPA, 2025[71]).

← 5.  The US states identified are Arkansas, California, Colorado, Florida, Louisiana, Minnesota, Oklahoma, South Carolina, South Dakota and Washington (Golnaraghi and Vichev, 2025[44]).

← 6.  For example, in the United States, deductibles for earthquake coverage are usually 10%-20% of the sum insured (NAIC, 2024[147]) which means that policyholders could face a significant uninsured loss.

← 7.  In response to the COVID-19 restrictions on economic activity, a number of governments provided subsidies for job retention programmes that reduced the loss of income for employees in sectors where business operations were disrupted (OECD, 2021[7]).

← 8.  Business interruption coverage is normally incorporated as an endorsement or add-on to property insurance coverage and, in many countries, is generally only triggered when the insured suffers property damage. Many policies include some coverage for losses incurred due to restrictions in access to the policyholder’s premises, including as a result of orders by a civil authority, but this coverage is also often linked to a requirement for property damage to have occurred in the vicinity of the insured premises. In addition, some insurance companies apply exclusions for any damages or losses resulting from a pollutant, contaminant, virus and/or bacteria. With some exceptions, most of the disputes over coverage related to the restrictions imposed during COVID-19 found that the presence of a virus in the vicinity of the property did not constitute property damage. In the case of policies that provided some coverage for business interruption losses related to communicable diseases, it was usually concluded that COVID-19 was not covered as a listed disease (Fearnhead and Stubing, 2025[148]).

← 9.  For example, one global reinsurance company is offering a customisable risk transfer solution for epidemic and pandemic risks although it is noted that the available coverage will be limited (Munich Re, n.d.[149]).

← 10.  In many countries, insurers are not authorised to provide coverage for some types of fines and penalties. In addition, in some countries or in some circumstances, insurers are not allowed to reimburse the cost of ransom payments (OECD, 2020[164]).

← 11.  For example, one 2024 survey of individuals found that only 19% of respondents had been offered coverage for cyber risks (von dem Knesebeck and Kreuzer, 2024[150]) although it’s not clear whether this was due to limited availability of cyber coverage for individuals and households.

← 12.  In the case of infectious disease outbreaks, coverage is not generally available so no conclusions can be drawn on the affordability of such coverage.

← 13.  Based on an EIOPA analysis of premium costs and disposable income (as outlined in (EIOPA, 2025[162]), 25-50% of households in Lithuania could face premiums for wildfire and windstorm risks that are unaffordable. In Poland, more than 25% of households could face unaffordable flood insurance premiums, more than 50% could face unaffordable premiums for coverage of coastal floods and wildfires (although these are not generally treated as separate perils in offered insurance coverage), and more than 75% could face unaffordable premiums for earthquake coverage (although earthquake risk is low in Poland). In Romania, 25-50% of households could face unaffordable coverage for coastal flood, earthquakes and floods, and 50-75% could face unaffordable coverage for wildfires and windstorms. In Slovenia, 25-50% of households could face unaffordable coverage for floods, and 50% to 75% could face unaffordable coverage for earthquakes (EIOPA, 2025[71]).

← 14.  The Actuaries Institute has proposed that households that pay more than four weeks of gross income in household insurance premiums are “affordability-stressed” (Paddam et al., 2024[62]).

← 15.  Average household insurance premium rates reportedly increased by 56% in Florida, 55% in Louisiana, 51% in the District of Columbia, 43% in Colorado and 42% in Utah (Golnaraghi and Vichev, 2025[44])

← 16.  In EIOPA’s Dashboard on insurance protection gap for natural catastrophes, insurance penetration is measured as the sum insured against each natural hazard risk relative to the overall value of property in the given country (EIOPA, 2025[71]).

← 17.  Insurance penetration is estimated to be below 50% for one or more natural hazard perils in Austria (flood, wildfire), Bulgaria (all included hazards), Croatia (all included hazards), Czechia (earthquake), Denmark (earthquake), Estonia (coastal flood, flood, wildfire), Finland (coastal flood), Germany (coastal flood), Greece (all included hazards), Hungary (wildfire), Italy (all included hazards), Latvia (coastal flood, earthquake, flood, wildfire), Lithuania (all included hazards), the Netherlands (coastal flood, earthquake, flood), Portugal (all included hazards), Romania (all included hazards), the Slovak Republic (all relevant included hazards), Slovenia (coastal flood, earthquake, flood) and Sweden (coastal flood) (EIOPA, 2025[71]). It is also estimated to be below 50% for earthquake, coastal flood and wildfire risk in Poland. However, earthquake risk is low in Poland and wildfire and coastal flood risk are not considered separate perils in the insurance policies offered in Poland (wildfire is considered part of fire coverage and coastal flood is considered part of flood coverage).

← 18.  OECD calculations based on data provided by Swiss Re (Swiss Re, sigma database. All rights reserved.).

← 19.  Less than 20% economic losses since 2000 were insured In Argentina, Brazil, Bulgaria, Colombia, Costa Rica, Croatia, Estonia, Greece, Hungary, Indonesia, Italy, Korea, Latvia, Lithuania, Peru, Poland, Portugal, Romania, the Slovak Republic, Slovenia and Türkiye (OECD calculations based on data provided by Swiss Re (Swiss Re, sigma database. All rights reserved.).

← 20.  More than 50% of economic losses since 2000 were insured In Australia, Belgium, Canada, Denmark, Finland, France, Ireland, Luxembourg, the Netherlands, New Zealand, Norway, Switzerland, the United Kingdom and the United States (OECD calculations based on data provided by Swiss Re (Swiss Re, sigma database. All rights reserved.).

← 21.  The data on annual economic losses is from Swiss Re (Swiss Re, sigma database. All rights reserved.).

← 22.  The period 2005-2014 included significant earthquake losses in Chile, Japan and New Zealand.

← 23.  According to one report, the average number of significant cybersecurity incidents reported each quarter was 650% higher in 2024 relative to 15 years earlier, the likelihood of an organisation experiencing a cyber event has quadrupled, median losses have increased from USD 190 000 to nearly USD 3 million – and extreme events have increased to USD 32 million (Cyentia, 2025[142])

← 24.  For the purpose of this estimate, cyber catastrophes were defined as events that resulted in more than USD 800 million in losses and affected more than one company (Johansmeyer, 2024[32]).

← 25.  One recent study in the United States, for example, found some evidence that a lack of insurance coverage could be linked to significantly higher rates of mortgage foreclosure in the aftermath of significant events. The study analysed foreclosure rates in communities impacted by hurricanes, wildfires and floods and found that foreclosure rates were more than 50% higher in areas outside of Special Flood Hazard Areas where insurance coverage was less likely to have been required by mortgage lenders (in the United States, mortgage lenders usually require property insurance that includes coverage for wildfire and wind and coverage for flood within Special Flood Hazard Areas) (First Street, 2025[151]).

← 26.  A review of examinations of the relationship between COVID-19 mortality and indicators of deprivation from across the world found that 91% of those examinations observed significantly higher mortality rates in areas of social disadvantage (McGowan and Bambra, 2022[92]).

← 27.  In the United States, for example, some of the most impacted sectors included accommodation and food services; arts, entertainment, and recreation; educational services; health care; manufacturing; and retail trade (GAO, 2023[103])

← 28.  Large internationally-active insurance companies can also establish diversified pools of risk by assuming uncorrelated risks from their different regions of operation.

← 29.  In 2025, the top 19 reinsurers had catastrophe budgets of just over USD 20 billion (Bhojani et al., 2025[163]) compared to USD 12.5 billion allocated by the top 20 reinsurers in 2020 (S&P Global Ratings, 2019[153]).

← 30.  In 2025, the outstanding value of issued catastrophe bonds and insurance linked securities for all perils was USD 58.883 billion relative to 33.351 billion in 2020 (Artemis, n.d.[154]).

← 31.  Between 2020 and 2023, the largest reinsurers covered an average of 14.7% of insured catastrophe losses, down from 23.3% between 2016 and 2019 (simple average), indicating that the share covered by primary insurers through their retentions increased (Bhojani, 2024[152]). In 2025, the largest reinsurers only covered 11% of total insured catastrophe losses (Bhojani et al., 2025[163]).

← 32.  For example, an examination of model outputs for a cyber catastrophe with a 1-in-50 year return period found that loss estimates varied significantly across the different commercially-available models (ranging from USD 5.5 billion to USD 24.4 billion) (Cordonnier and Davis, 2023[143])

← 33.  An OECD analysis in 2021 examined the potential impact of lower revenues and higher leverage ratios on investment and estimated that investment could be 2% lower as a result of the impacts of the pandemic on revenues and leverage (Demmou et al., 2021[155]).

← 34.  Simple average based on growth in outstanding business loans at current prices in national currency.

← 35.  Business bankruptcies were higher in Canada, Finland, Hungary, New Zealand, Sweden and the United Kingdom.

← 36.  Between 2015 and 2024, the (re)insurance sector absorbed approximately USD 103 billion in natural hazard losses annually, compared to approximately USD 59 billion annually between 2000 and 2014. The share of losses insured increased from 40.3% in 2000-2014 to 50.8% in 2015-2024. OECD calculations based on data provided by Swiss Re (Swiss Re, sigma database. All rights reserved.)

← 37.  The share of earthquake losses insured declined from 21.4% in 2000-2014 to 19.2% in 2015-2024, although this may have been driven by differences in the level of coverage where earthquakes occurred during the two periods. The share of overall natural hazard losses insured declined by more than 10 percentage points in 2015-2024 (relative to 2000-2014) in Estonia, New Zealand and Thailand. OECD calculations based on data provided by Swiss Re (Swiss Re, sigma database. All rights reserved.)

← 38.  According to one reported estimate, cyber insurance premiums are expected to almost double from USD 15.3 billion in 2024 to USD 30 billion by 2030 (Shiltagh and Meley, 2025[156]).

← 39.  The report found that, under the “Payroll stream” of the programme, the administrator identified 50 970 of the 51 010 ineligible recipients of loans. However, under the “Non-deferrable expenses stream”, the administrator only identified 30 of the estimated 26 150 ineligible recipients due to a lack of post-payment verifications (Office of the Auditor General of Canada, 2024[130]).

← 40.  For example, insurance associations and companies are making natural hazard risk maps, claims data and modelling tools available to support risk awareness in many countries around the world (OECD, 2023[101]).

← 41.  A number of large insurance companies and intermediaries regularly provide climate risk information to corporate policyholders and have set up specific risk management consulting units to provide risk management and risk reduction advice to corporate clients (OECD, 2023[101]).

← 42.  For example, insurance companies in the United States offer premium discounts for measures that enhance the resilience of homes against hurricane and wildfire risks (Smart Home America, n.d.[157]). In Germany, insurance companies have offered premium discounts to households with high-levels of exposure to flood risk that have implemented risk reduction measures (Seifert-Dähnn, 2018[158]).