Gaps, overlaps and confusion persist in cyber cover cyber

Varying degrees of cyber cover are available in most traditional lines of insurance, but exclusions are on the rise and wordings constantly evolving, leaving risk managers confused, according to panellists at the Advisen Cyber Risk conference. Most traditional P&C insurance policies in some way cover cyber risk, such as a cyberattack or a systems outage. But policy wordings have yet to adapt to the growth in cyber and technology risks, and working out the amount of cover in traditional policies is no easy task. According to Johnny Fraser, cyber reinsurance broker at Capsicum Re, cyber cover is difficult to track across lines of insurance, with a lack of “uniformity” between lines of business. For example, offshore energy uses cyber exclusions and write-backs, while the onshore energy market is silent on cyber. There are also overlaps of cover between lines of business, explained Mr Fraser. For example, crime insurance and directors and officers insurance can include cover that is found in cyber insurance, he said. Russell Kennedy, divisional director at Lloyd’s insurer Brit, also sees lots of gaps and overlaps in cyber cover. “There is huge overlap and that creates a lot of confusion for the insured, who will need a lot of help from an adviser to identify where a cyber policy overlaps with traditional insurance policies,” he said. When looking at property insurance, the available cyber cover only meets a small proportion of clients’ needs, continued Mr Kennedy. “There are a series of property/casualty lines where cyber language is mostly inadequate for client requirements,” he said. “As a market we have a duty to look at wordings and the adequacy of exclusions,” said Mr Kennedy. “At the moment there is not contract certainty. Parties are not clear on the cover at the start of the policy,” he added. The lack of clarity and ambiguity that exists in traditional insurance policies is ripe for disputes and protracted claims settlement. For example, the WannaCry and NotPetya malware attacks in 2017 created a number of coverage disputes, according to Mr Kennedy. Wordings are flexible and arbitrated, causing claims to back up, he said. “Clients want certainty of cover. Risk managers say they do not know which policy to turn to or which policy would respond to WannaCry. Having a clear understanding of what is covered is to everyone’s benefit,” said Mr Kennedy. The insurance market is still “immature” when it comes to cyber wordings and exclusions, according to Julian Miller, partner at UK law firm DAC Beachcroft. He believes there are now about 17 standard cyber exclusions in the London market, three of which were drafted this year alone. However, there is concern among insurers over the effectiveness of cyber exclusions in traditional insurance, explained Mr Miller. DAC has reviewed the effectiveness of insurers’ cyber wordings on a red, amber and green traffic light ranking. “Almost none of the wordings were ranked green and that is a sobering message that insurers need to think about,” he said. The UK financial regulator, the Prudential Regulatory Authority, has been pushing insurers to tackle cyber exposures in traditional insurance. It wants insurers to either exclude cyber or quantify the exposures, price for it and cover the risk. At the same time, Lloyd’s has been overseeing a drive in its market to identify silent cyber exposures in traditional lines and clarify coverage. Cyber exposures in traditional insurance can be either direct or indirect, according to Scott Stransky, assistant vice-president and principal scientist at catastrophe modelling firm AIR Worldwide. Direct cyber coverages can lurk in property policies, such as a fire or explosion at a plant caused by technical malfunction or cyberattack. Liability policies can also be triggered by a cyber event, such as a data breach that gives rise to regulatory actions or litigation against a director. Insurers are also exposed to indirect losses, such as business interruption caused by a power outage resulting from a cyberattack. Mr Stransky recalled a recent cyberattack against a hurricane warning alert system in Texas, which overwhelmed emergency services and therefore impeded their ability to respond. One of the issues believed to be holding back the insurance industry when it comes to cyber is scarcity of expertise and available talent, an issue that applies to the wider cybersecurity sector. Cyber expertise is typically concentrated in insurers’ specialist cyber insurance teams, and is only now beginning to cross over to traditional lines. The cyber insurance market is drawing on the expertise of other markets to broaden cover, rather than adding cyber into traditional lines of business, explained Jacqueline Spencer-Sim, cyber liability underwriter at Axis Capital. This might protect limits in traditional policies that could be exhausted by cyber losses, she explained. “Property, business interruption and crime could be written clearly into the cyber policy by the correct underwriter,” she said. Mr Kennedy expects traditional policies to expand and include some affirmative cyber cover, but believes the majority of cyber risk will be covered by specialist insurance. Even so, some cyber risk will always reside in traditional insurance, he said. For example, cyber-induced fires are likely to become a bigger issue for connected buildings and devices, according to Mr Stransky. Electronic locks could be hacked or connected heating systems tampered with, resulting in theft or physical damage. Such losses will need to be covered by property insurance, he said. Despite this frank assessment of problems with covering cyber risk, insurers and brokers taking part in panel debates at the conference railed against criticism that the cyber insurance market is failing to meet the needs of business.

Gaps, overlaps and confusion persist in cyber cover cyber

Want to read this article?

Read Next

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

Want to read this article?

Read Next

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

Related Articles