Aon calls for cyber innovation to ‘multiply and magnify’

Closing the cyber protection gap will require innovation in coverage and distribution, according to an Aon-hosted cyber risk webinar. The cyber insurance market is growing rapidly, yet many companies still do not buy cyber insurance, according to insurers and brokers taking part in the online panel debate. “Only 60% of firms wish to buy cyber insurance in the current landscape. I think that statement is alarming. We have a situation where it is the most exposed asset class, with a product there to support that protection, yet people don’t want to buy it,” said David Malony, head of cyber solutions for EMEA at Aon. The insurance industry needs to ask itself if it is doing enough to maintain the right levels of attractiveness to new buyers, or those that stopped buying cyber insurance due to market volatility, according to Malony. It also needs to ask whether organisations truly understand their changed risk profile and asset class portfolio, he said. There has been a massive change in the security and technology landscape, with an increase in the value of intangible assets, according to Malony. The average value of intangible assets is 2.45% higher than tangible assets for listed companies globally. At the same time, the likelihood of loss is higher for intangible assets than for tangible. However, only 17% of intangible assets are insured, compared with 60% of property, plant and equipment, he said. “Frankly, when we look at it, the protection gap right now is enormous, and we require multiplied and magnified levels of innovation, to combat the challenges we are seeing right now, and into the future, because this challenge is going to grow,” he said. According to Aon data, the cyber insurance market has grown from just $2bn in 2016 to $14bn in 2023. The broker predicted that the cyber insurance market will see 15% annual compound growth in the foreseeable future. “For an industry traditionally focused on the downside risk protection, that is actually quite a unique and incredible growth story,” said Rory Egan, head of cyber analytics at Aon Reinsurance Solutions. However, the future size of the cyber market will depend on growth in SME and penetration into non-English speaking markets, which remains a challenge, he said. There are also many industries that are underserved by cyber insurance, including airline, marine, transport, logistics, agriculture and mining, according to Egan. Only around 30% of companies in a recent Aon survey are buying insurance today, he noted. Global cyber insurance premium is also currently concentrated in a small number of markets. The US, UK, Canada and Australia are the top four cyber insurance markets: North America accounts for 70% of premiums and Europe 20%, with Japan and Australia making up the majority of the rest of the world. The policy count in the US increased 18% last year, although premiums overall were flat due to rate reductions, according to Egan. Cyber insurance has a “distribution issue” according to Sophia Waßner, chief underwriting officer and global head of cyber for Munich Re Facultative and Corporate. Around half of companies have never actively been offered cyber insurance, while the other half is not consciously buying, or not buying enough, because the coverage is unclear, the limits insufficient, or coverage is not meeting expectations, she explained. While awareness for cyber risk is relatively high amongst corporate decision makers, many feel that they are not sufficiently protected from the cyber threat, according to Waßner. “In my view there is a product available that, to a certain extent, can help with these issues, but we have to recognise the distribution is not ideal. In our figures we find 20% of c-level representatives do not even know cyber insurance exists. Another 20% do know it exists, but they don’t understand it sufficiently to make it a comfortable buy. And a third of potential buyers are not picking up cyber insurance because it is too expensive in their mind,” she said. Insurers need to do a “better job” of explaining and evolving the cyber product so it fits the needs of buyers, said Waßner. At the same time, corporates really need to understand their risk profile and quantify their cyber risk in order to enter into a discussion about what kind of product is fit for their needs and budget, she said. “Cyber insurance will never be a substitute for strong and healthy IT security and resilience. It is a very powerful tool in your risk management toolbox, but it will never be a substitute. It is there for residual risks that remain on your books, even if you do everything right,” said Waßner. While insurers are keen to grow in cyber, they are having to balance this growth with concern for accumulation risk from events like CrowdStrike, ransomware attacks and the evolving cyber threat, explained Egan. “Cyber is a risky and challenging line of business from an insurer perspective, as you have the risk of large single losses in the hundreds of millions from a single company or ransomware attack or data breach – so you have a severity issue. You also have frequency of claims issues with the rise of ransomware as a service, and criminal gangs that are financially motivated continuing to evolve techniques that maximise financial gain,” he said. “You also have the widespread attacks like CrowdStrike, that come from reliance on technologies that ultimately act as single points of failure. And that is probably the main source of fear for some insurers historically, understanding, managing, and pricing that catastrophe risk continues to be a huge area of focus,” said Regan. Exposures and financial loss potential are increasing with digitalisation and increasing levels of value creation towards IT infrastructure, according to Waßner. Supply chain cyberattacks, in particular, are on the rise, with around half of all organisations having suffered a supply chain ransomware attack, she said. “CrowdStrike showed us how quickly things can get broad. Even if I call this a near miss – things did not go as badly as they could have done – it still reminds us that there is an issue that we need to control, and that we need to continue thinking about modelling these accumulation risks and aggregation potential on the insurance side,” said Waßner. “We on the insurance side expected [CrowdStrike]: It was modelled, it is to some extent priced, and it is transferable if a client is looking for that kind of [non-malicious] cover. It is also a good prompt for our buyers to rethink their scenarios, their profiles, where they see their own exposure, how they quantify it, and which piece of it do they actually want to transfer,” said Waßner. To further unlock growth, insurers need to make the insurance product more meaningful for buyers, and continually adapt to the changing risk landscape, as well as develop new distribution channels, according to Egan. “Small to medium-sized enterprises have been typically less served by cyber insurance previously. So, getting more policies into the hands of SMEs is going to be key,” he said. Reinsurance also plays a key role in the growth of the cyber insurance market, according to Egan. Around 40-50% of premium is ceded to reinsurers while around 15% of capital supporting the insurance market is from third party capital providers, including cyber catastrophe bonds, cyber industry loss warranties and parametric solutions, he noted. “The future of cyber insurance is bright because so much is happening around innovating new ways to transfer that risk and we expect that to continue,” said Egan.

Aon calls for cyber innovation to ‘multiply and magnify’

Head of cyber solutions for EMEA at Aon David Malony says the cyber protection gap is ‘enormous’

Want to read this article?

Read Next

Inflation and rising prices to drive Australian general insurance growth

Marsh expects European cyber rates to continue softening next year

Munich Re and ERGO target higher profit in 2025

Ransomware to target larger organisations next year, warns Moody’s

US commercial insurance market stable for buyers but sense of fragility remains

Inflation and rising prices to drive Australian general insurance growth

Marsh expects European cyber rates to continue softening next year

Munich Re and ERGO target higher profit in 2025

Ransomware to target larger organisations next year, warns Moody’s

US commercial insurance market stable for buyers but sense of fragility remains

Keep yourself informed

Sign up for Commercial Risk’s newsletters

Want to read this article?

Read Next

Inflation and rising prices to drive Australian general insurance growth

Marsh expects European cyber rates to continue softening next year

Munich Re and ERGO target higher profit in 2025

Ransomware to target larger organisations next year, warns Moody’s

US commercial insurance market stable for buyers but sense of fragility remains

Related Articles

Keep yourself informed

Sign up for Commercial Risk’s newsletters