Cyber Insurance Risks Are Moving Too Fast For Underwriters

Today with the growing number of inter-connected systems, devices and machines there is no business without Cyber risk and these emerging perils can provide exciting opportunities for insurance firms to pursue organic growth but they also require a continual and growing understanding of the changing market and some underwriters are falling behind.

The prospect of deploying capital into a new product like cyber insurance, and potentially becoming a market leader in that space, is something nearly all insurers strive towards. However, the speed of change is making it difficult for underwriters to stay ahead of the game.

Cyber is by far one of the hottest new perils to grasp the attention of insurance markets worldwide. Market capacity has grown considerably in the past decade, spurred on by developing social and regulatory frameworks around privacy and personal data protection, as well as a sharp uptick in malicious cyberattacks.

Cyber insurance was born as a business interruption coverage for non-malicious cyber-triggered loss events. Since then, the product has evolved to protect firms against privacy breaches, malicious cyberattacks, systems failure coverage, contingent business interruption and contingent business failure.

As a net new peril, some of those coverage aspects are still very difficult to underwrite, particularly when assessing contingent risks, according to Josh Ladeau, global head of tech E&O and cyber at Aspen Insurance.

“We’ve reached a situation where the cyber insurance market has so much capacity and there’s so much focus on cyber as an area for growth in insurance, that the market’s almost moving a bit faster than we can genuinely underwrite to,” Ladeau told Insurance Business.

“If we look at contingent business interruption risk, for example, the quality of a given risk is reflective of its scrutiny of the third-parties it does business with.

“Typically, a cybersecurity-driven organisation will tend to choose third-party vendors that also demonstrate good levels of cybersecurity and resilience. Underwriters have some capability to write around that, but contingent risk remains an exponential threat which is difficult for underwriters to wrap their arms around.

“Furthermore, the limits and the nature of that contingent coverage has changed in the past year. Whereas a year ago, underwriters could get away with naming vendors they would consider for third-party business interruption risk, now they’re under pressure to offer blanket coverage at full limits for all of the vendors in a particular insured’s third-party relationship tree.”  

The ardent market enthusiasm for an emerging peril is not a new phenomenon, but if capacity grows out of control, that’s when cracks can start to appear.

Ladeau pointed out that capacity in the cyber insurance marketplace is currently outpacing appetite for the risk, a dynamic which has created a depression on pricing and rates.   

“It’s very interesting to watch what happens as losses develop in the cyber space,” Ladeau commented. “So far, a loss for a given risk has typically only had a temporary and narrow impact on that industry class. For example, a large loss like the Marriot breach, might cause a small shift in pricing around hospitality as an industry segment, but only for a short amount of time. The industry currently has a short memory around some of these losses.

“Even massive losses, like a potential limit loss on a $350 million tower, aren’t necessarily slowing the risk selection appetite of most cyber markets. You might see a few players backing away, but there are always markets ready to take their place.”

Some of the most significant cyber losses to date occurred in 2017. The NotPetya and WannaCry attacks shook the entire world, causing large aggregated losses with wide-reaching implications.

In the same year, US credit agency Equifax suffered a data breach that affected 143 million consumers and JPMorgan suffered one of the biggest bank breaches in history.

As the industry experiences more aggregated cyberattacks, the portfolio strength of insurers will likely be tested and the pack might thin out, according to Ladeau.

“Lots of markets have entered the cyber space and are playing it in the same way they would any other professional services product. With something like lawyers’ professional liability, offering $10 million in excess of $100 million for relatively thin rate is often considered a safe way to build a portfolio.

“We’re seeing markets take similar capacity plays for cyber insurance, but in reality, the cybersecurity landscape is completely different. There’s a different trajectory for typical loss in cyber,” Ladeau commented.    

“I think that’s being learned by the market, but again, the amount of capacity available is almost overshadowing that for now. What I think you’ll see in the future is a greater frequency of these mass-level attacks, more acknowledgement of that threat by insurance companies, and greater understanding that cyber events are more often tower-implicating losses rather than small-level losses on accounts.

“That will thin out the crowd in terms of the amount of high-excess capacity players there are in the market, which I think will start to drive a change in pricing as well as hopefully some constriction around coverage grants.”   

Insurance Business

You Might Also Read:

Insurance: Common Cyber Security Myths:

« Meeting The Cyber Talent Challenge Head-On
NASA's Daily Shutdown Threat »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

IASME Consortium

IASME Consortium

IASME is one of five companies appointed as Accreditation Bodies for assessing and certifying against the UK Government's Cyber Essentials Scheme.

DigiCert

DigiCert

DigiCert is the only provider of enterprise-grade SSL, IoT and PKI solutions. Our certificates are trusted everywhere, millions of times every day, by companies across the globe.

Pervade Software

Pervade Software

Pervade Software is a global provider of dedicated compliance tracking software with monitoring & reporting capabilities.

Acunetix

Acunetix

Acunetix is a leading web vulnerability scanner, widely acclaimed to include the most advanced SQL injection and XSS black box scanning technology.

IntaForensics

IntaForensics

IntaForensics offer a full range of digital investigation services and are able to adapt to the individual needs of solicitors, private clients, Law Enforcement Agencies and commercial businesses.

Bit4id

Bit4id

Bit4id provides software and systems for security and identification based on PKI technology.

cPacket Networks

cPacket Networks

cPacket’s distributed intelligence enables network operators to proactively identify imminent issues before they negatively impact end-users.

SafeBreach

SafeBreach

SafeBreach's platform simulates hacker breach methods across the entire kill chain to identify breach scenarios in your environment before an attacker does.

Elemental Cyber Security

Elemental Cyber Security

Elemental is a game changing cyber security compliance automation and enforcement technology provider.

Adaptive Shield

Adaptive Shield

Addaptive Shield - Complete Control For Your SaaS Security. Proactively find and fix weaknesses across your SaaS platforms.

Tapestry Technologies

Tapestry Technologies

Tapestry Technologies supports the Department of Defense in shaping its approach to cybersecurity.

Safetech Innovations

Safetech Innovations

Safetech Innovations is a team of cyber security experts, always at your service. We use human and cyber intelligence to help your business in uncertain times.

StrikeReady

StrikeReady

StrikeReady have developed CARA, an advanced technology solution that offers personalized and proactive assessment and remediation of future and current risk in real-time.

BlockAPT

BlockAPT

BlockAPT, empowering you with an advanced, intelligent cyber defence platform. We protect our customers digital assets by unifying operational technologies against advanced persistent threats.

Intelligent CloudCare

Intelligent CloudCare

Intelligent CloudCare, a division of IPS, is a full IT Services provider serving the needs of SMBs in the metropolitan New York City region.

Vortacity Cyber

Vortacity Cyber

Vortacity is a boutique cybersecurity provider specializing in associations, nonprofits, and mission-based organizations.