Cyber BI cover on the table as European market hots up

In recent weeks, brokers in the London market have been marketing a new business interruption policy that covers physical damage caused by an attack on so-called SCADA systems, the automated control systems used in critical infrastructure and manufacturing. These computer-controlled systems, which remotely operate equipment in industries ranging from energy to brewing, have been shown to be vulnerable to cyber attacks, software glitches or simple human error, potentially resulting in large property and BI losses. Since the Stuxnet computer worm, supposedly developed by the US to disrupt the Iranian nuclear programme, was discovered in 2010, commercial firms have realised they too could be deliberately targeted or caught up in a wider attack.hideHowever, some property insurers, especially in the energy sector, exclude physical damage triggered by cyber threats, while standalone cyber policies do not cover physical property damage. But Laila Khudairi, a cyber underwriter from Lloyd's insurer Kiln, said: "We are providing tailored solutions and offering cover that plugs this gap." In addition to bespoke solutions, such as the one offered by Kiln, business interruption cover is also being promoted via a growing number of cyber insurance products aimed at European companies. Cyber insurance currently falls into two main areas of risk-the costs and liabilities associated with a data breach involving personal information and the property damage and BI consequences of a security breach or network outage. To date, insurers have mostly targeted the burgeoning market for data breach insurance, which primarily provides insurance against the costs and liabilities associated with the loss of sensitive information, either accidental or through hacking. The risk is relatively attractive to insurers because notification costs are easy to quantify and there is ready demand, especially in the US where data protection laws require companies to notify customers of a breach. Some 90% of cyber insurance is sold in the US to cover data breaches at companies based in the country, according to Graeme Newman of CFC Underwriting, a Lloyd's managing general agency. Over the past year some of the most successful cyber insurers in the US-Beasley and AIG-have begun to offer standalone cyber insurance in Europe. In the past three months Zurich, AXA, Allianz and Chubb have all launched cyber insurance products targeting non-US companies. However, these offerings are largely based on those already sold by these companies in the US. "Privacy is a relatively easy sell in the US, but this approach is misguided in Europe," said Mr Newman. "In Europe it is more about cyber first party business interruption and property first party damage. All businesses need technology to operate and if there is system interruption they will suffer a loss," he said. The leading cyber insurers are being attracted to Europe in the belief that European data protection laws will soon toughen, helping to boost demand in what has been an underdeveloped market for cyber insurance. Proposals to strengthen and harmonise European data protection legislation should stimulate and accelerate demand because any requirement to notify in a breach situation is expensive, believes Paul Bantick, Head of TMB in the UK at Beazley. Beazley's flagship policy, Beazley Breach Response, is the number one product in the US and is now being rolled out in Europe. As yet the cyber insurance market in Europe has not taken off because few buyers feel the costs associated with a data breach warrant purchasing cover, explained Ben Beeson of insurance broker Lockton in London. However, despite the proposed European Data Protection Directive there is no guarantee that the cyber market will evolve in Europe in the same way as in the US. Even if the costs of dealing with a breach end up comparable to those in the US, the region is less litigious, noted Mr Beeson. In the next few years there will be an increase in demand, but to sell cyber insurance successfully in Europe insurers will have to be more intelligent, such as offering BI and reputational damage, said David Rees of London-based broker RKH. "Those are the covers that will lead to the upturn in Europe." Switzerland-based insurer Zurich concedes that the purchasing drivers in Europe will not be the same as in the US. This summer Zurich launched a standalone cyber product in Europe and is working on a new UK and international product. "It is clear that privacy is not the focus for international clients...business interruption will be more of a driver for buying cyber insurance in Europe," said Jeremy Smith, Head of Technology at Zurich Global Corporate. In the past, some European insurance buyers have criticised insurers for being slow to develop cyber insurance, especially outside the US and beyond the scope of privacy cover. The insurance industry is currently not fully meeting the needs of large corporates, agreed Mr Beeson, noting the gaps that exist in both property and cyber insurance. "But things are changing and there is work going on behind the scenes, particularly in the Lloyd's market. Things are moving in the right direction and cover is starting to broaden out," he said. Property damage and business interruption caused by a network outage or a security breach are areas that insurers are starting to work on, said Mr Beeson. London market insurers are going further and combining property with cyber BI cover to respond to demand for broader bespoke BI insurance, he added. For example, Lloyd's insurer Kiln is offering bespoke cover for intangible and tangible property exposures linked to cyber triggers. It has even developed specific cover for SCADA systems. "The insurance industry is not providing as broad a cover as it should. It is not covering the full range of cyber exposures and few insurers have had an appetite for cyber BI," said Kiln's Ms Khudairi. "Kiln is broadening cover to meet clients' demands," she added. Lloyd's underwriters have demonstrated a willingness to underwrite property damage and BI exposures, but the capacity for large facilities is not yet there, according to Stephen Wares, Cyber Practice Leader for the EMEA region at broker Marsh. The broker is working with both cyber and property markets to find a solution, he said. Insurers will 'follow the money' and go where there is the greatest demand, said Mr Wares. But client concern over business interruption has been surprisingly low. A recent Marsh survey of its clients found the threat was ranked well behind that of a data breach, damage to reputation and loss of intellectual property. However, demand for cyber BI insurance should increase as more organisations recognise the high dependency on IT for trade, said Mr Wares. Insurers are looking for events other than data breaches to target their products, such as business continuity issues caused by a security event, negligence or accidental damage. "This is a market where we can expect movement as insurers respond to clients' demands. If the demand is there and risk managers can articulate it, insurers will respond," said Mr Wares. Even in the US demand for property damage and business interruption cover will eventually emerge. One possible driver could come from the US government, which is particularly concerned with the threat of cyber risks to critical infrastructure. The US administration is interested to explore what role insurance could play in raising cyber security standards, explained Mr Beeson, who recently met with President Obama's security advisers on this very issue. The US cyber insurance market, which is now worth around $1bn, is based around data breach and privacy insurance, but that may change with time, according to Zurich's Mr Smith. "This type of cover is an easy sell for brokers in the US, therefore the market has not focused on the more complex area of cyber-related business interruption," he said. Mr Smith sees potential for continued growth in privacy-related cyber insurance in the US. But once that market becomes saturated, interest in BI will also grow, he predicts. "The exposure is there but the product is not pushed hard," he said. Some even believe that the property market will eventually assume cyber-related property exposures. "First party property damage and business interruption cover will be absorbed into property programmes," said Beazley's Mr Bantick. "Breach response will continue to take priority and ancillary policies will become less important," he added.

Cyber BI cover on the table as European market hots up

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Related Articles