European risk managers cite inadequate cyber cover in new survey

Advisen's fourth annual Network Security & Cyber Risk Management survey, sponsored by Zurich, finds that 47% of respondents do not take out cyber insurance because they believe it does not cover their exposures. According to the 2015 survey, 20% of the European risk managers and insurance buyers polled said they do not take out cyber cover because it is too expensive and 7% because inadequate limits are available. A further 27% cited other reasons, including the fact they have not yet evaluated the risk. Speaking at the survey's launch in London on Tuesday, Jeremy Smith, Head of Technology and Security & Privacy at Zurich, said he was "amazed" by the high number of respondents that still feel cyber insurance does meet their needs. He said coverage is increasingly broad and intimated that now is a good time to transfer cyber risk because the growing threat could reduce the scope of insurance going forward. He said the risk transfer industry must do more to educate clients on the solutions now available in the market.hide"I can understand that buyers may have an issue with cost, but 47% (who believe cyber insurance does not cover their risk) is quite a high number, particularly bearing in mind how much the cyber insurance market has developed during the past couple of years. I think policies are now as wide as they have been and I think, if anything, over the next few years we will probably see polices actually covering less as a result of the amount of cyber attacks and the data breach epidemic that we are seeing," said Mr Smith. He added that the perception among buyers that cyber insurance will not cover their needs is a result of insurers and brokers failing to properly communicate the solutions on offer. "I think there is still a communication problem for the insurance market as a whole, in terms of speaking to clients and getting them to understand exactly what products and solutions are out there in the marketplace at the moment," he said. The annual Network Security & Cyber Risk Management survey attempts to gauge awareness of cyber risk and the evolution of its management, as well as monitoring risk transfer strategies in Europe. 61% of respondents to this year's survey were based in the UK, 26% in the European Union (EU), 11% in non-EU European countries and 3% were from the US. The majority of respondents worked for multinational enterprises - 34% have branches or subsidiaries in more than 20 countries outside the EU, 26% are present in six to 20 countries, 16% in two to five countries and 5% in a single country. Just 18% percent of respondents came from companies that only operate in their country of origin. The survey also represents businesses of all sizes but is weighted towards larger companies. Overall, 76% of respondent companies have annual turnovers in excess of £1bn and 58% have in excess of 5,000 employees. The survey suggests that 35% of European firms now buy cyber cover, up from 33% last year. However, Mr Smith said this figure is not necessarily representative of the broader business community. Respondents to the survey are more likely to be focused on cyber risk than the general business community and therefore more likely to place cyber insurance, he pointed out. Of those respondents that purchase cyber coverage, 88% said they have done so for less than two years and 13% for between three and five years. None of the respondents have had coverage in place for more than five years. The vast majority (88%) purchases a standalone (mono-line) policy and 13% said they purchase cover as part of another policy. None of the respondents have ever had a cyber insurance claim. The 2015 survey reveals that after three consecutive years of growth, the percentage of European risk managers that perceive cyber risk as at least a moderate threat dropped to 89%, from 98% in 2014. This percentage, however, is in line with levels seen in a similar survey of the US risk management community. Larger European-based companies with a turnover greater than £1bn (96%) perceive cyber risk as at least a moderate danger, compared to 67% of small to medium-sized enterprises with a turnover of less than £1bn. This year's survey shows that cyber risk continues to be viewed as a significant threat by both senior executives and board members. A total of 69% of respondents said cyber risk is viewed as a threat by their board of directors. This is down slightly from 76% in 2014 but still above the US at 64%. Overall, 74% of respondents said their senior executives view cyber risk as a significant threat. This figure is also down from the 83% seen in 2014 but slightly above the US at 72% As with last year year's survey, damage to an organisation's reputation is seen as the top cyber risk, followed by privacy violation/date breach of customer records and theft/loss of an organisation's assets and intellectual property. Business interruption is ranked as the fourth highest risk. These findings throw up "no major surprises", said Mr Smith. The survey also reveals that 58% of respondent firms have a data breach response plan in place, which is consistent with previous years. "Over half have data breach response plans in place, but this still on the fairly low side," said Mr Smith. "They are key to managing reputation and keeping overall costs down in the event of a data breach. We urge all risk managers to have such a plan in place," he added. He noted that underwriters like to see evidence that data breach response plans are in place when placing and pricing cyber risk. The survey shows that European organisations increasingly include network security risks as part of their cyber risk management efforts. The figures stand at 97%, up 7% on last year and the fourth consecutive year the figure has increased. It stood at just 27% in 2012. By a wide margin, the IT department is still seen as the front line of defence against information losses and other cyber risks. Seventy-nine percent of respondents said IT is responsible for spearheading the information or network security risk management effort, with risk management/insurance coming in a distant second on 9%. Mr Smith said that although IT is an important cog in the cyber risk management wheel, the effort should incorporate the wider enterprise. He was encouraged that the survey revealed 45% of companies are taking a multi-departmental approach to cyber risk management. The survey also finds that 75% of respondent organisations have a social media policy in place. 79% said they have mobile device security policy in place. Both figures are roughly in line with last year's numbers. European organisations are increasingly likely to have a 'bring your own device' policy in place, according to the survey. In this year's study, 75% of respondents said they had such a policy in place, up 12% on last year and 34% higher than in 2013. In conclusion, Mr Smith said cyber risk increasingly seems to be part of the broader risk management focus. "We have seen an uptick in polices being placed and the use of cyber-related business continuity plans," he said. "Cyber insurance continues to form part of that overall risk management strategy and we are seeing growth patterns that look much more like the US model. But we can be doing better. The insurance industry as a whole can still do more to communicate with and educate our clients around cyber risk and the products and services that we offer," he said.

European risk managers cite inadequate cyber cover in new survey

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Related Articles