Cyber risk management improving in Europe

CRE spoke to James Tuplin, head of international cyber at AXA XL, about some of the trends in cyber risk and insurance management to find out the current state of play. He discussed areas in which risk and insurance managers are improving, as well as where and how they can up their game. Ben Norris: What is the state of cyber risk management in Europe? Is it finally improving? James Tuplin: It is getting better. I would say Europe has lagged behind the US when it comes to IT security for the last half a dozen years. I think this was predominantly a result of the type of US laws in place for over a decade that we are now just seeing in Europe with the implementation of the GDPR last year. Consequently, companies in the US have had more than ten years to boost their risk management. But in Europe we haven’t quite got to the same level just yet. The really large European conglomerates that have bought cyber for several years have quite good protocols in place. It is the companies that are newer to this conversation and have only really joined it over the last year or two that are now having to play catchup. There are a lot of these firms. Most companies are still trying to work out their biggest exposure, the best ways to protect the risks and how much insurance cover they might need. The risk management knowledge tends to decrease the further down the chain you go. BN: Who exactly is carrying out the risk management? Who should be doing this and how? JT: Until fairly recently, the risk of IT failure had been the premise of the head of IT security. That person knows how IT works and fails, but is not well versed in business risk. So they don’t necessarily know how badly an event could affect the company. The risk manager knows the cost if certain elements of the company go down. But they are not necessarily on top of how secure something is, and what extra things should be put in place to mitigate the risk. This is something the IT manager will understand better. So the key is getting the risk manager to talk IT and the IT manager to talk business risk. That’s all this is at the end of the day – another business risk. Remember that cyber is just a trigger and treat the risk as you would other triggers. You know a fire can trigger business interruption and will know how much it would cost because you will have done studies. You then buy insurance for that scenario. You need to do the same for IT. What is the business risk you are worried about? What can cause that to happen? How do you protect against it? Start to apply what you already know. That is where the risk management comes in. You don’t need to reinvent the wheel. But there is a fear and panic because the issue is IT and cyber, which can sometimes confuse people. However, risk managers are beginning to get on top of this. I see it more and more where they own that space. Or quite often it is a dual role – where IT and risk management work together. In those instances, the risk manager comes to us with the head of IT security because he or she knows they need that understanding and language to supplement their own. We are moving in that direction. The situation is improving but it is taking time. It takes three to five years to learn. So risk managers need to upskill. BN: Where can risk managers get the skills and knowledge from? JT: It is more difficult to get from traditional sources because there aren’t books and books on this. Nor are there consultants that have 100 people working on it. And the advice you are given today may be different in a year’s time. So you need more than one risk adviser. You need various people to help. Your insurers and brokers are an element of it because we are right at the coalface of this and know what we are looking for. But there are risk management firms, IT firms, legal firms that are beginning to specialise in this space. You can start to find good consultants. However, there are a lot of people that say they are specialists so it is about finding the best ones. BN: What key bits of advice would you give to companies looking to get the most from cyber insurance? JT: Firstly, if you want to know what insurers can do and what they need from you, get in front of them and talk to them. We want to talk to you. Secondly, either understand your own risk when you come to us or understand that you don’t understand it and be open about that. Very often I am told, ‘we don’t have this exposure’, and in five minutes I can prove otherwise. If you don’t understand your exposure that badly, then I am not insuring you. Tell us you are not perfect and what you are doing about it. That is a better story than hiding things or glossing over them. Thirdly, get the basics and fast. The basics are very much what you think of for your home insurance, for example. I am talking firewalls, virus protection, decent password controls and so on. Don’t let everyone access everything all of the time. If you are a large company and you don’t have a business continuity plan, it raises questions. But if you can come along with some basics in place and be open about the rest, you will get some really good responses. And finally, make sure it is cyber insurers that you should be taking to. Because if it is indirect cyber cover you are after, don’t talk to us. In that instance, talk to your property or marine underwriter or whoever else makes the most sense. BN: Are industrial and manufacturing firms more interested in buying cyber insurance and associated services following NotPetya and WannaCry than they were previously? JT: Definitely. Easy answer. Yes. Until about 18 months ago, industrials were very much on the lesser curve. People were really worried about data. NotPetya and WannaCry were a wakeup call to the industrials. They realise now it is not just data that can be stolen and monetised. Ransomware can get in your system and you can do nothing until you pay some money. It has made people realise that their IT ecosystem, especially in industrial controls, controls everything. Everything is internet-controlled. We saw a rush in the six months after NotPetya and WannCry with mostly manufacturing, but industrials in general, starting to pay a lot more attention to cyber risk and insurance. The manufacturing sector is a very busy marketplace for me now in Europe. That sector is a very common buyer of cyber insurance. Industrials are very much looking for help on the services side to get on top of the risk, perhaps more so than other sectors. The manufacturing firms haven’t come as far as others in understanding the different elements of the risk. So providing services at the front end to help them understand, measure and mitigate their exposure is beneficial. They want the advice, plain and simple. But they also need services on the back end to process the claims. So manufacturers are really struggling on both ends of the spectrum.

Cyber risk management improving in Europe

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Related Articles