Buyers face coverage uncertainty as liability market moves to exclude silent cyber

Insurance buyers will encounter growing cyber exclusions in liability policies at renewal, with attempts to address silent cyber liability proving a complex task that is creating coverage uncertainty for policyholders. Insurers are now beginning to develop and apply cyber exclusions to non-physical cyber liability, according to Jean Bayon de la Tour, head of cyber at Marsh in continental Europe. Broadly, the goal of liability insurers is to provide affirmative cover for bodily injury and third-party property damage, while excluding non-physical cyber liability, such as third-party liability losses from a privacy or security event, he explained. “Ultimately, we believe physical cyber exposures will need to remain in property damage and general liability policies, but non-physical exposures will be covered by the cyber insurance market,” predicted Mr Bayon de la Tour. This is a global trend, he added. Willis Towers Watson is also seeing exclusions added to liability policies as they come up for renewal, although there is no dominant market pattern emerging, according to Laure Zicry, head of FINEX cyber at the broker. “Some insurers have included new silent cyber exclusions in their liability and property policies for 2020. Others plan to do so, but only for 2021 renewals, and are not making any changes this year,” she said. AIG hopes to eliminate silent cyber from the bulk of its commercial insurance policies by January 2020, and is one of the insurers now applying privacy and bodily injury cyber exclusions and write-backs to general liability and product liability policies. The insurer will also address silent cyber in professional liability and other financial lines, including directors and officers, although this may take longer, according to AIG’s head of cyber in the EMEA region, Mark Camillo. “At AIG we are introducing cyber liability exclusions for renewals in 2020. However, this is a process that will take time. It is important to have discussions early and for customers to understand the impact and look at what can be added in, or if a separate policy is needed,” he said. Zurich Insurance has said silent cyber cover will generally be eliminated in its policies by year-end 2020, except where such an approach is prohibited by statute or where a specific reference to cyber would be inappropriate due to the nature of the product, such as with certain general liability policies, according to Sierra Signorelli, chief underwriting officer for commercial insurance at the insurer. “In certain lines of business, cover for cyber exposures will be expressly provided given the nature of the relevant exposures, such as on certain professional indemnity lines. On other lines, such as motor and workers injury, Zurich will continue to offer the coverage inherent in these products where it is not possible to affirmatively cover or exclude cyber due to statute or established market practice,” she explained. “Where Zurich intends to afford cyber coverage in any manner, it will be underwritten, and clear policy language will continue to be provided to our customers,” she added. However, actions by insurers to address silent cyber are creating uncertainty, according to Mr Bayon de la Tour. A lack of cyber expertise among traditional casualty underwriters, and the absence of standard exclusions and definitions for silent cyber in the liability market, are resulting in overly broad exclusions and varying approaches by different insurers, he said. Some buyers are seeing insurers insist on adding silent cyber exclusions in their liability policies for the first time at renewal, which is causing concern. “These actions raise difficult questions for clients who do not understand what this change means for their exposures and how they should respond,” said Mr Bayon de la Tour. The process of addressing silent cyber liability has now started but will take more time than tackling first-party silent cyber, according to Mr Camillo. “The changes required in liability are significant and implementation is complex. There were no standard cyber exclusions in the market, and the language has had to be created and operationalised,” he said. “Discussions around silent cyber for property are now taking place ahead of the 1 January renewals, and conversations for more complex casualty will be had during the next year or so. There is already a push for clarity around cyber cover in property and this will not be a surprise. But there is a more difficult conversation yet to come on casualty,” Mr Camillo added. Silent cyber for liability risk and insurance is a complex problem and will take time to work through, agreed Hans Allnutt, partner at law firm DAC Beachcroft and head of its cyber and data risk team. He said liability policies were not designed or underwritten for event-based triggers, such as a cyberattack. “It can be harder to apply wholesale cyber exclusions, because the effect would be to exclude claims for which the policy is specifically designed, such as claims against directors or by employees,” he explained. “Cyber liability losses can be harder to quantify than physical damage caused by cyberattacks, where insurers can draw on historical data on physical damage claims,” continued Mr Allnutt. “There is plenty of data on the cost of fire losses, for example, but in liability there is a lack of developed case law on how much can be claimed, which makes it difficult to identify and quantify exposures,” he said. Minimum terms and conditions set by regulators and professional bodies – such as liability for professions like accountants and lawyers – also pose a challenge for cyber liability insurance, explained Julian Miller, an insurance coverage lawyer and partner at DAC Beachcroft. For example, professional liability insurers are paying cyber-related claims like business email compromise and Friday afternoon fraud, but they are not able to exclude such risks under minimum terms, he said. When Allianz Global Corporate and Specialty (AGCS) set out to address silent cyber in its liability policies – one of the first international insurers to do so – it had to develop its own cyber exclusions because market solutions were lacking. “When we first looked to address silent cyber, we looked for standard market clauses. While we see these in property, engineering and marine, we did not find a suitable one in liability. So, we had to develop our own clauses,” said Marek Stanislawski, deputy global head of cyber and tech PI at AGCS in Stockholm. “We ask ourselves whether it is the intention of underwriter, broker or client to have such claims covered under a liability policy. If the answer is yes, then we can agree on the intention and provide affirmative cover and underwrite it. If not, we make that intention explicit too, and the customer can ask for an extension or buy a cyber insurance policy,” he said. The broad AGCS exclusion has been applied to general liability, product liability and some aviation liability policies renewing since March 2019. Mr Stanislawski said it has generally been welcomed by clients. “We have developed a model liability clause for cyber and technology that looks like a broad exclusion, but with a variety of buybacks. Cover is made explicit by adding agreed carve-backs,” he said. However, AGCS takes a different approach in products like D&O, where the intention is to cover losses even when they arise from a cyber event. “This is our standard in D&O cover, so there is no need for an exclusion. However, we have put affirmative cover in place to confirm that losses arising from a cyber peril will be covered,” said Mr Stanislawski. AIG is also looking to make cyber cover affirmative for D&O. “For financial lines such as directors and officers insurance, we are adding exclusions and clarifications. Cover for indirect cyber will still be there for D&O. If a director faces a securities claim for a cyber-related corporate governance issue, the policy will still respond but it would be excluded for entity liability,” said Mr Camillo. Silent cyber is currently present in almost every commercial insurance policy, mainly because contract language was developed long before cyber became an issue, explained Mr Stanislawski. He added that the biggest silent cyber issues in casualty products come from privacy-related exposures in general and professional liability policies, as well as potential shareholder class actions against directors and officers. Privacy and data breach exposures, including those under the GDPR, exist in a number of liability policies, according to Mr Allnutt. “Despite the advent of the GDPR, there is still a potential lack of certainty around whether liability policies would pick up all privacy-related liabilities from a data breach,” he said. While the liability market has been slow to address silent cyber, large losses could spur action in the future, according to Mr Allnutt. The GDPR and trend towards class action data breach litigation, as well as contract-related cyber liability litigation, are giving rise to increased third-party liability, which could stimulate insurers to address exposures, he said. “If you are looking for the event that will catapult the silent cyber project in liability lines onto centre stage, it would be a dispute over a cyber claim. The accelerators for silent cyber in property were losses that were then denied and challenged,” said Mr Stanislawski.

Buyers face coverage uncertainty as liability market moves to exclude silent cyber

Want to read this article?

Read Next

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Major cyberattack would hike rates but insurers would ‘brush off’ losses: Lockton Re

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Major cyberattack would hike rates but insurers would ‘brush off’ losses: Lockton Re

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Want to read this article?

Read Next

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Major cyberattack would hike rates but insurers would ‘brush off’ losses: Lockton Re

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Related Articles