Cyber Insurance Has Distinctly Risky Characteristics

Although cyber risk premiums have expanded sizably in recent years with loss ratios that compare favorably to other product lines, the danger of accumulation risks is a key concern for the market, according to a study released by insurance industry think tank The Geneva Association.

The study, titled “Advancing Accumulation Risk Management in Cyber Insurance,” identifies three prerequisites to a sustainable cyber insurance market:

• Customers and insurers must facilitate resilience at the source of risk for the principles of insurability to apply.

• Insurers must be able to achieve an acceptable return on capital.

• Insurance markets need to be able to withstand shocks from extreme events, which means absorbing accumulation risk.

The concern about accumulation risk is widely held across the industry and is the reason the Geneva Association report is focusing on the market’s ability to withstand extreme events, said Anna Maria D’Hulster, secretary general of The Geneva Association (GA), in a forward to the report.

“Expanding the boundaries of insurability is not new for insurers. However, cyber risks are taking us into uncharted territory,” she added. “Both exposures and threats have distinct characteristics, which give rise to unprecedented challenges.”

“These challenges require that insurers strengthen their core underwriting capabilities, in particular exposure measurement, claims assessment, and accumulation modelling,” the study said.

The report went on to highlight four cyber accumulation risk challenges:

• A single large event or a series of consecutive events may make affirmative cyber insurance unprofitable. (The report explained that insurers provide affirmative coverage in standalone and package policies).

• Insurers and reinsurers (for which risk accumulation may be more pronounced than for primary insurers) could underestimate non-affirmative cyber exposure leading to an unplanned shock from a major event. The report explained that non-affirmative cyber exposure occurs when a cyber attack causes major losses by triggering coverages in other classes. [Editor’s note: Insurers face non-affirmative, or silent cyber exposures, when they offer all-risk policies and other liability insurance policies that have not excluded cyber risks.]

• Data are of insufficient quality, are incomplete and/or lack the necessary consistency for more advanced modeling techniques.

• Governments predominantly fail to provide frameworks for the sharing of large-scale cyber-terrorism-induced losses.

Market Consequences

The study said there are many market consequences if risks from these challenges materialize.

“Insurers and reinsurers could withdraw from the market after unacceptably high losses and fear of repeat events,” the study continued, noting that such losses also could stall the growth of the small alternative capital market and prevent insurers from accessing needed capacity.

In addition, re/insurers could introduce tighter policy terms and increase the number of exclusions and/or make buy-backs prohibitively expensive, the GA study said.

“The lack of confidence in advanced model outputs could stifle growth if models are deemed to be too blunt for insurers to extend portfolios or offer higher coverage levels,” which could result in a further constraint on the amount of coverage available for larger enterprises and leave the market for small and medium enterprises underdeveloped.

“A large event may also trigger regulatory intervention with the risk for insurers having to provide cover with uneconomic terms and rates,” GA said.

In response, GA said, insurers have formulated several approaches:

• Developing data analytics that analyze the characteristics of cyber risk as well as data protocols that combine company infor­mation with digital risk indicators.

• Novel approaches to analyzing the risk “footprint” and corresponding threats affecting the size of the footprint. For example, the mathematics of epidemiology could be applied to the spread of computer viruses.

• Forward-looking threat assessments including external expert inputs, while developing in-house technical know-how.

• Mapping cloud-related interconnectivity and digital supply chains, and using machine learning to assess the relationship between claims frequency and multi-dimension exposure.

• “Of equal importance is the need to maintain underwriting discipline. Cyber risk is not unique in this respect. Historically, many property-casualty classes have suffered when underwriting standards slipped or when prices failed to adequately reflect the cost of risk,” the study went on to say.

“Many insurers perceive the current rating environment as soft and likely inadequate should any of the above risks materialize,” the study added. “Furthermore, the growing threat from terrorism adds urgency to such concerns, and the appropriate treatment for this risk in war and terrorism exclusions will be key.”

Cyber Models

Accumulation modeling supports a greater understanding of risk interconnectivity, whether on a wide scale or within specific industry segments, which improves the ability of underwriters to accept risk, the study affirmed.

Market development is likely to continue to benefit from modeling advances, said the report, expressing cautious optimism that as long as underwriting discipline is maintained “insurers are well-positioned to ensure the cyber insurance market’s viability and achieve sustainable growth in the future.”

“Cyber risk has distinct characteristics. Exposure bases are hard to define and measure. Historical claims data are scarce and not good predictors. Threats are constantly evolving, can spread widely and rapidly, and a series of consecutive large events is plausible. Moreover, a high degree of interconnectivity may result in potentially boundless impacts,” said Daniel Hofmann, senior adviser Insurance Economics at The Geneva Association and primary author of the study, in a statement.

Insurance Journal:

You Might Also Read:

Insurers Are Not Ready For IoT

« Catching The Silent Attacker, And The Next Phase Of Cyber AI
NATO Live-Fire Cyber Exercise »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

OASIS Open

OASIS Open

OASIS Open is where individuals, organizations, and governments come together to solve some of the world’s biggest technical challenges through the development of open code and open standards.

BPC Banking Technologies

BPC Banking Technologies

BPC’s advanced fraud prevention solution helps card issuers and acquirers combat the growing threat by monitoring 100% of transactions, online, in real-time across all channels.

Labris Networks

Labris Networks

Labris Networks specializes in DDoS mitigation, NG Firewall, Unified Threat Management, Centralized Management, Regulatory Compliances and SOC/CERT Services.

ISARA Corp

ISARA Corp

ISARA Corporation is a security solutions company specializing in creating class-defining quantum-safe cryptography for today's computing ecosystems.

Bangladesh Computer Council (BCC)

Bangladesh Computer Council (BCC)

Bangladesh Computer Council (BCC) is a government body providing support for ICT related activities including formulating national ICT strategy and policy.

Blancco Technology Group

Blancco Technology Group

Blancco Technology Group is a leading global provider of mobile device diagnostics and secure data erasure solutions.

Combis

Combis

COMBIS is a regional high-tech ICT company focused on the development of application, communication, security and system solutions and the provision of services.

Lithuanian National Accreditation Bureau

Lithuanian National Accreditation Bureau

Lithuanian National Accreditation Bureau is the national accreditation body for Lithuania. The directory of members provides details of organisations offering certification services for ISO 27001.

CipherBlade

CipherBlade

CipherBlade specializes in blockchain forensics, data science and transaction tracking.

ARCON

ARCON

ARCON offers a proprietary unified governance framework, which addresses risk across various technology platforms.

BreachQuest

BreachQuest

BreachQuest brings together cybersecurity experts with decades of experience identifying security flaws, penetrating networks, and responding to incidents.

Womble Bond Dickinson

Womble Bond Dickinson

Womble Bond Dickinson is a transatlantic law firm, providing high-quality legal experience and outstanding personal service from key locations across the United Kingdom and United States.

TriCIS

TriCIS

TriCIS design and engineer highly secure integrated solutions that meet the highest government and military security standards, providing information assurance to organisations across the globe.

Positka FSI Pte Ltd

Positka FSI Pte Ltd

Positka, being a Splunk Singapore partner, provides Splunk & Phantom Services, Cybersecurity & Risk Management, Analytics & Big Data, Lean Process Optimization, and Managed Security Services.

Offenso Hackers Academy

Offenso Hackers Academy

At Offenso we focus on cyber security training focused on producing cyber security professionals with a wide range of abilities to counter threats from the internet and cloud to a business.

ZehnTek

ZehnTek

ZehnTek is a premier technology solutions provider, committed to offering comprehensive IT services tailored to meet the diverse needs of businesses.