Cyber Insurance Risks Are Moving Too Fast For Underwriters

Today with the growing number of inter-connected systems, devices and machines there is no business without Cyber risk and these emerging perils can provide exciting opportunities for insurance firms to pursue organic growth but they also require a continual and growing understanding of the changing market and some underwriters are falling behind.

The prospect of deploying capital into a new product like cyber insurance, and potentially becoming a market leader in that space, is something nearly all insurers strive towards. However, the speed of change is making it difficult for underwriters to stay ahead of the game.

Cyber is by far one of the hottest new perils to grasp the attention of insurance markets worldwide. Market capacity has grown considerably in the past decade, spurred on by developing social and regulatory frameworks around privacy and personal data protection, as well as a sharp uptick in malicious cyberattacks.

Cyber insurance was born as a business interruption coverage for non-malicious cyber-triggered loss events. Since then, the product has evolved to protect firms against privacy breaches, malicious cyberattacks, systems failure coverage, contingent business interruption and contingent business failure.

As a net new peril, some of those coverage aspects are still very difficult to underwrite, particularly when assessing contingent risks, according to Josh Ladeau, global head of tech E&O and cyber at Aspen Insurance.

“We’ve reached a situation where the cyber insurance market has so much capacity and there’s so much focus on cyber as an area for growth in insurance, that the market’s almost moving a bit faster than we can genuinely underwrite to,” Ladeau told Insurance Business.

“If we look at contingent business interruption risk, for example, the quality of a given risk is reflective of its scrutiny of the third-parties it does business with.

“Typically, a cybersecurity-driven organisation will tend to choose third-party vendors that also demonstrate good levels of cybersecurity and resilience. Underwriters have some capability to write around that, but contingent risk remains an exponential threat which is difficult for underwriters to wrap their arms around.

“Furthermore, the limits and the nature of that contingent coverage has changed in the past year. Whereas a year ago, underwriters could get away with naming vendors they would consider for third-party business interruption risk, now they’re under pressure to offer blanket coverage at full limits for all of the vendors in a particular insured’s third-party relationship tree.”  

The ardent market enthusiasm for an emerging peril is not a new phenomenon, but if capacity grows out of control, that’s when cracks can start to appear.

Ladeau pointed out that capacity in the cyber insurance marketplace is currently outpacing appetite for the risk, a dynamic which has created a depression on pricing and rates.   

“It’s very interesting to watch what happens as losses develop in the cyber space,” Ladeau commented. “So far, a loss for a given risk has typically only had a temporary and narrow impact on that industry class. For example, a large loss like the Marriot breach, might cause a small shift in pricing around hospitality as an industry segment, but only for a short amount of time. The industry currently has a short memory around some of these losses.

“Even massive losses, like a potential limit loss on a $350 million tower, aren’t necessarily slowing the risk selection appetite of most cyber markets. You might see a few players backing away, but there are always markets ready to take their place.”

Some of the most significant cyber losses to date occurred in 2017. The NotPetya and WannaCry attacks shook the entire world, causing large aggregated losses with wide-reaching implications.

In the same year, US credit agency Equifax suffered a data breach that affected 143 million consumers and JPMorgan suffered one of the biggest bank breaches in history.

As the industry experiences more aggregated cyberattacks, the portfolio strength of insurers will likely be tested and the pack might thin out, according to Ladeau.

“Lots of markets have entered the cyber space and are playing it in the same way they would any other professional services product. With something like lawyers’ professional liability, offering $10 million in excess of $100 million for relatively thin rate is often considered a safe way to build a portfolio.

“We’re seeing markets take similar capacity plays for cyber insurance, but in reality, the cybersecurity landscape is completely different. There’s a different trajectory for typical loss in cyber,” Ladeau commented.    

“I think that’s being learned by the market, but again, the amount of capacity available is almost overshadowing that for now. What I think you’ll see in the future is a greater frequency of these mass-level attacks, more acknowledgement of that threat by insurance companies, and greater understanding that cyber events are more often tower-implicating losses rather than small-level losses on accounts.

“That will thin out the crowd in terms of the amount of high-excess capacity players there are in the market, which I think will start to drive a change in pricing as well as hopefully some constriction around coverage grants.”   

Insurance Business

You Might Also Read:

Insurance: Common Cyber Security Myths:

« Meeting The Cyber Talent Challenge Head-On
NASA's Daily Shutdown Threat »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Hex Security

Hex Security

Hex Security Limited is a specialist Information Assurance (IA) consultancy working with associates and partners to deliver security certification and accreditation support.

Intercede

Intercede

Intercede is a cybersecurity company specializing in digital identities, derived credentials and access control, enabling digital trust in a mobile world.

Authenware

Authenware

AuthenWare delivers the highest level of identity security based on behavioral biometrics.

Arcanum Information Security (AIS)

Arcanum Information Security (AIS)

Arcanum Information Security is a specialist Information Assurance Consultancy and a leading provider of Cyber Security services to UK Defence, UK Government, Enterprise businesses and SMEs.

Standards Council of Canada (SCC)

Standards Council of Canada (SCC)

SCC leads and facilitates the development and use of national and international standards and accreditation services in Canada.

Logic Supply

Logic Supply

Logic Supply is a global industrial PC company focused on hardware for the IoT edge. We design highly-configurable computers engineered for reliability.

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp is the world’s largest network of multi-corporate backed accelerators helping startups scale internationally.

Inceptus

Inceptus

Inceptus is a next generation Managed Security Service Provider (MSSP). We are dedicated to keeping our customers safe, secure and protected while doing business on the Internet.

River Loop Security

River Loop Security

River Loop Security specialize in solving complex cybersecurity challenges in the IoT and embedded devices space.

Hudson Cybertec

Hudson Cybertec

Hudson Cybertec are an internationally recognized Subject Matter Expert for cyber security in the Industrial Automation & Control Systems (IACS) domain.

Purple Knight

Purple Knight

Purple Knight is a free Active Directory security assessment tool built and managed by an elite group of Microsoft identity experts.

Datastream Cyber Insurance

Datastream Cyber Insurance

DataStream Cyber Insurance is designed to give SMB’s across the US greater confidence in the face of increasing cyber attacks against the small and medium business community.

Cerby

Cerby

Your team uses unmanageable applications that put you, your company, and your data at risk. Protect, secure, and accelerate your business automatically with Cerby.

CatchProbe Intelligence Technologies

CatchProbe Intelligence Technologies

CatchProbe provides actionable web intelligence, OSINT, deception systems, threat intelligence, and digital crime analytics solutions and products through an AI-Driven intelligence platform.

TriCIS

TriCIS

TriCIS design and engineer highly secure integrated solutions that meet the highest government and military security standards, providing information assurance to organisations across the globe.

TetherView

TetherView

TetherView provides leading virtual desktop and email security technology to help businesses stand up and manage digital workspaces.