Cyber Risk Insurance: A View From The Prudential Regulation Authority

Cyber risk is increasingly prevalent in insurers' thinking, both in considering new product lines and in assessing the risks to which they, and their insureds, are already exposed.

In recent years, the Prudential Regulation Authority (PRA) has made efforts to understand and guide the insurance industry in this space.

Its recently published conclusion however is that the exposure to cyber risk is currently being underrated by insurers.

The PRA's review

Between October 2015 and June 2016 the PRA worked with various organisations associated within the cyber risk insurance sector, including insurance and reinsurance firms, cyber security consultancies, technology firms and regulators to assess the potential exposure to cyber risk claims.

This resulted in the publication of its results in November 2016 along with a Consultation Paper. A final Supervisory Statement was published in July 2017.

The PRA's review focused not only on affirmative cyber insurance policies, but also on the exposure to risk which was presented by implicit cyber exposure, a subject which they referred to as the 'silent' cyber risk, or in less catchy terms, "non-affirmative" cyber risk.

Silent risk

The potential cyber risks associated with many policies are not always clear on first consideration. It may at first appear excessive to exclude cyber claims in, say, a casualty policy. Indeed, why would you need to protect an insured against a cyber risk when they are looking to insure themselves against injury claims by their employees or third parties?

However, an increasingly automated world is giving rise to instances where an IT failure could render essential equipment faulty, in turn, causing someone to be injured.

Silent risks also exist in other policies. Director and Officers (D&O) policies, in particular, are open to cyber threats given the impact of technology in effectively steering a business.

Should a business be hit by a cyber-attack, it may find itself vulnerable to a loss in revenue, ultimately leading to shareholders pursuing the directors if the business was not properly prepared, triggering a D&O claim.

Elsewhere, events stemming from a cyber-attack may give rise to complications for various professionals, leading to them being incapable of performing their role sufficiently, in turn leading to a potential professional indemnity claim. This threat extends to financial institutions and general liability claims.

Even where the link between cyber breaches and potential liabilities is clearer, the PRA is concerned that the risk has not been adequately dealt with. The aviation world, despite the continual automation of aviation electronics, appears to be taking the position that the risk of exposure to cyber risk is minimal.

Likewise, property underwriters, whilst accepting that cyber-attacks are becoming increasingly likely to impact upon developments in smart-home technology, are, according to the PRA, not fully accounting for such risks.

Issues in addressing silent risks also extend to reinsurance contracts. Whilst the PRA acknowledges that reinsurers are becoming increasingly aware of the potential exposure brought about by silent cyber risks, they also found that reinsurers have to date been reluctant to utilise methods to limit their exposure.

But the times they are a changing. The PRA's review provided evidence that reinsurers have developed wording to address the issue, albeit the wording in question was both bespoke and had only recently been introduced. Of greater concern is that the wordings remain untested, and have not been adopted universally, leading to uncertainty.

Governance requirements

Knowing which policies to focus on is only the first step. Insurers have been mandated with clearly assessing and monitoring both their affirmative and silent cyber risk policies. The PRA's Supervisory Statement asks insurers to produce clear strategies, along with risk appetite statements for the management of associated risks, to be owned by the boards of those firms.

Clarifying their recommendations, the PRA have recommended that a firm's strategy should make clear, amongst other things, the markets they wish to pursue, their intention for managing silent cyber risk, rules relating to line sizes, aggregate limits and splits between direct insurance and reinsurance.

Once formulated, strategies are to be maintained by the board, and reviewed on a regular basis, ensuring they remain relevant, assisted by an aggregate cyber underwriting exposure metric for both affirmative and silent risk. Such measures are designed with the intention of identifying the potential for loss aggregation, through a variety of exposures, over extreme return periods.

Greater knowledge needed

Where insurers do not invest in data breach resources they may find themselves exposed to challenges not faced in other policy types. The long tail impact of a cyber-attack on an insured may see repercussions lasting months, even years after the event, and bring about a range of losses which are likely to prove difficult to quantify.

The quantification of potential losses is made harder by the lack of past claims data in the UK to measure the losses against.

Internal dissemination of information also plays a part. In the absence of personnel with a cyber breach skillset, the PRA is concerned that firms will struggle to keep other relevant staff, including risk management teams, abreast of developments in this quickly evolving sector.

The consequences are risks being assessed on outdated information or principles, which may lead to a policy being ill-constructed to protect an insured against risks, or an insurer being blind to the level of liability it may be facing. The PRA is clearly encouraging greater investment in staff or external advisors who have experience of assessing and managing cyber risks.

Increasing risk in the future

Cyber risk will be front and centre in the thinking of many businesses in the months ahead, particularly with the implementation of the GDPR in May 2018. GDPR is likely to increase the exposure to cyber risk faced by insurers, primarily through affirmative cyber policies, but also the silent risks detailed above.

In the months ahead, businesses will be faced with a tougher European regulatory framework on personal data, leading to the need for an increasingly rigorous standard of data governance to be maintained.

Another, as yet untested, area is the potential for insurers to meet regulatory fines. These have trended upwards in recent years and are set to rise substantially following the introduction of the GDPR.

Accordingly, the insurance sector needs to be alive to the risks ahead, but also the opportunities presented. The PRA Supervisory Statements calls for underwriters to consider the implications of cyber risks when drafting all form of policies, either affirmatively including, or expressly excluding, any exposure to cyber breaches.

They are also asked to assess the potential for cyber-attacks to lead to aggregated risks in several different areas and with long tails.

The PRA has offered advice regarding steps firms can take to better equip themselves for cyber risk exposure. These include making adequate capital provision, adjusting premiums to reflect additional risks, offering explicit cover, introducing robust wording exclusions, or attaching specific limits of cover.

Implementation of these steps is intended to enhance the ability of insurers to monitor, manage and mitigate silent cyber risk and to increase contract certainty for policyholders as to the level and type of coverage they hold.

Despite the PRA's concerns, market trends indicate insurers are becoming increasing alive to the potential impact of cyber risk on the insurance landscape. The growing list of insurers and other professional advisors offering cyber breach experience is a sign things are moving in the right direction.

However, this remains a complex and fast moving field, where expertise is in high demand, but those with genuine practical cyber breach experience are short in supply.

The answer is likely to be found in a collaborative effort between insurers, experts and third party consultants to share their experiences and expertise to help better understand the risk landscape.

For free Cyber Insurance consultancy please email:  info@cybersecurityintelligence.com and we will give you advice and suggestions on who to contact for opinion/insurance

Lexology:

You Might Also Read: 

Cyber Insurance Report 2017 - 2018 (£):

Strategies For A Cyber Security Culture (£):

 

« AI Applied To Video Analytics
Artificial Intelligence Needs Regulation »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Japan Information Security Audit Association (JASA)

Japan Information Security Audit Association (JASA)

JASA is non-profit association active in developing and managing the quality of Information Security Auditing and Auditors in Japan.

SentryBay

SentryBay

SentryBay is the global leader in preventative endpoint isolation protection. We protect remote, BYOD and corporate endpoints so they can safely and securely connect with your corporate network.

FraudHunt

FraudHunt

FraudHunt protects your website from account fraud, ad fraud, fraud clicks, and malicious bots.

Bright Machines

Bright Machines

Bright Machines delivers intelligent, software-defined manufacturing by bringing together our flexible factory robots with intelligent software, production data and machine learning.

Nihon Cyber Defense

Nihon Cyber Defense

Nihon Cyber Defence’s mission is to provide robust solutions, services and support to governments, corporates and organisations in order to protect them from all forms of cyber warfare.

NexGenT

NexGenT

NexGenT have combined military-style training with decades of network engineering and cyber security experience into an immersive program to get people into cyber security fast and effectively.

HighPoint

HighPoint

HighPoint is a leading technology infrastructure solutions provider offering consultancy, solutions and managed services for network infrastructure and cybersecurity.

Cybersecurity Center for Secure Evolvable Energy Delivery Systems (SEEDS)

Cybersecurity Center for Secure Evolvable Energy Delivery Systems (SEEDS)

SEEDS conducts research and develops innovative cybersecurity technologies, tools, and methodologies that advance the energy sector’s ability to survive cyber incidents.

Dynamic Quest

Dynamic Quest

Dynamic Quest is a managed IT, cloud and security services companies, providing a comprehensive range of technology services including cybersecurity, backup and disaster recovery.

comforte AG

comforte AG

comforte AG is a leading provider of data-centric security technology. Organizations worldwide rely on our tokenization and format-preserving encryption capabilities to secure personal, sensitive data

RealTyme

RealTyme

RealTyme is a secure communication and collaboration platform with privacy and human experience at its core.

Obscure Technologies

Obscure Technologies

Obscure Technologies is a firm of experts, specialised in brokering the best security solutions to market.

Incyber

Incyber

Incyber is a fully integrated network and cybersecurity solutions provider contracted to safeguard public and private enterprise, high value data and sensitive industries.

inSOC

inSOC

inSOC is an enterprise-grade AI-driven SOCaaS solution detecting breaches 24/7 with vulnerability management built-in. Designed for MSPs and MSSPs.

CSIRT-Gnd

CSIRT-Gnd

CSIRT-Gnd provides 24x7 Computer Security Incident Response Services to citizens, companies and government agencies in Grenada.

OOKOS

OOKOS

OOKOS was founded in 2023 by a team of cybersecurity veterans who recognized that traditional security models were failing to keep pace with evolving threats.