Growing cyber awareness and mitigation efforts failing to reduce risk, says Marsh CEO

Cyber risk awareness is growing and more money is being spent on mitigation but this is not yet leading to a reduction in the risk, John Doyle, president and CEO of Marsh, told delegates at an OECD conference in Paris yesterday. Business, the insurance industry and governments need to rethink their approach to cyber risk and work more collaboratively to find better solutions, he said. In his opening keynote address at the OECD’s Unleashing the Potential of the Cyber Insurance Market event in Paris yesterday, Mr Doyle posed the question of whether increasing cyber risk awareness and resources to tackle the threat are leading to a reduction in cyber risk? “The answer is, not yet,” he told attendees at the event held in collaboration with Marsh. He cited poor cyber risk identification and measurement as a key reason for this lack of progress. Mr Doyle pointed to the joint Marsh-Microsoft Cyber Risk Perception Survey published last week that found 34% of companies do not carry out any cyber risk measurement. Fewer than half of respondents said their organisation estimates financial loss from cyber events. “It’s difficult to make smart investments if you’re not measuring potential loss. This is where the science of risk management and insurance can add value,” said Mr Doyle. He said that insurance alone cannot provide all the solutions to cyber risk, while the full breadth of exposures cannot by transferred to the insurance market. But he stressed that insurance can play an important role in helping companies get a better grip on their cyber exposures. “Cyber insurance opens the door to a full view of cyber risk’s potential economic cost. Applying for cyber insurance prompts companies to evaluate assets and controls. It encourages measurement against well-established benchmarks, and asks companies to calculate potential losses in hard financial terms,” said the broker. In addition, insurance can help companies improve cybersecurity via value added services and reward best practice in terms of premium cost. However, take up of cyber insurance remains low, with global premium a fraction of other lines of coverage. There are several reasons for this, argued Mr Doyle. Risk managers remain confused about cyber coverage and, in many cases, are unconvinced it will protect them, or perform, when needed, noted Marsh’s CEO and president. According to the Marsh-Microsoft survey, only 16% of executives believe that cyber insurance meets all their needs, and only half buy—or plan to buy—coverage. Such sentiment appears related to insurers’ apparent inability to properly tackle cyber. As Mr Doyle noted, this is partly because insurers are worried about this unpredictable and difficult to quantify risk. “Carriers are concerned about catastrophic events and aggregation,” he said. “There is obviously more work for the industry to do here,” continued Mr Doyle with lots of “untapped potential” for cyber insurance and much progress needed, he said. The OECD’s event this week is aimed at helping to unlock that potential and discussing how governments can work alongside the insurance industry and business to deliver progress. Mr Doyle noted that governments around the world are taking a hard look at cybersecurity and implementing new initiatives to boost mitigation. But he warned that “new cyber rules and regulations—if not created with stakeholder input—run the risk of fragmentation, stifling innovation, and becoming quickly outdated”. He called for a change in approach. “So, there are many well-intentioned efforts underway. It can be difficult to feel that, though, as the number of cyberattacks continue to rise and economic damages increase. The logical conclusion is that what we are doing is not working. We need to rethink our approach,” he told those gathered in Paris. “Better strategies can be advanced, but business, insurance and government must do their parts to find a better path,” he said. Adding: “Industry and government need each other more than ever”. Mr Doyle said businesses need to treat cyber risk as an enterprise-level issue, not just an IT concern. “Business leaders and boardrooms have to learn, engage, and set the course,” he said. “The private sector can do a better job of quantifying cyber risk, which will lead to more capital-efficient investments with measurable outcomes. And finally, business must achieve cyber resilience. Cyber risks cannot be eliminated but they can be managed,” he continued. Mr Doyle welcomed the leading role Ferma has taken in developing a cyber risk governance model to boost cyber risk management. He also stressed that the insurance industry needs to better educate its clients about the benefits of cyber insurance, and produce better tools and models to help clients keep pace with the risk. “We can also improve information sharing with key stakeholders, including governments. We commend Insurance Europe’s initiative to create a breach notification template to help insurers access anonymised data collected under the GDPR,” he said. Mr Doyle went on to call for more public-private partnerships when it comes to cyber risk and further efforts by governments. “Given the growth of state and organised crime-sponsored attacks, more can be done by all instruments of government. Convening stakeholders is an incredibly important role that governments can play to help define problems and find solutions. Policymakers can continue to develop national strategies for cybersecurity and promote development and coordination of best practices, which includes the adoption of cyber insurance,” he said. Concluding his speech, Mr Doyle said: “We [at Marsh] understand the importance of results-oriented cyber risk management and the need for new solutions to help clients meet tomorrow’s challenges. We believe cyber insurance can bring positive change in our communities by promoting cyber resilience and increasing the financial stability of our global economy. And, we will continue to support the OECD and dialogue on this critical issue of our time.”

Growing cyber awareness and mitigation efforts failing to reduce risk, says Marsh CEO

Want to read this article?

Read Next

Marsh launches global alternative risk solutions practice

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

Marsh launches global alternative risk solutions practice

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

Want to read this article?

Read Next

Marsh launches global alternative risk solutions practice

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

Related Articles