Grasping the full potential of cyber insurance

Cyber risk in its various forms seems to be one of the potential growth areas for the insurance industry and a big issue for organisations. Insurers are launching lots of new solutions and cyber risk continues to rate highly in many risk management surveys. This is, of course, not surprising given the news headlines about data breaches, cyber security issues and privacy debates. There is also the speed at which new technology changes and evolves—from big data, to cloud computing, to social media—and with it the risks and exposures faced by companies. No wonder that the insurance industry is taking an interest in this area. Last month’s JLT Global Digital Risks & Technology Forum in Salzburg saw a panel, comprising risk managers and service providers, tackle the issue of cyber insurance, examining whether policies meet the needs of risk managers and how far the insurance market has come in the last 15 years.hideThe panel was asked whether the insurance market had grasped the full possibilities of cyber insurance. On the buyers’ side, David Ralph, Senior Vice President, Risk Management, PCCW, said it was not so much a question of whether it is an opportunity for insurers, but whether companies actually need what is on offer. “Are insurers offering anything that we as buyers are interested in at the moment? I think that there is an intent and an expectation that it is a new avenue, but whether it is a standalone avenue, or whether it is something where we build enhancements into existing products where they already should be, is the more important question we should be looking at,” he said. The other risk manager on the panel, Peter Den Dekker, Insurance and Risk Manager at VimpelCom Ltd, said cyber risk presents an interesting opportunity for risk managers to strengthen their position. “We recently got together in one room with our insurers, their response service providers (IT forensics and legal/regulatory) and our own cyber security officers and data privacy officers to discuss risk response strategies and whether our insurers really had the experience to assist us, or do we know more than all of you?” he said. He went on: “And I think at the moment that we as a technology company know more on the technology and security side and the legal issue than the companies that are trying to assist us. That is not being critical, it is just reality. However, the risk and insurance manager can bring all these disciplines together and create a podium for ‘deep dive’ risk discussions and I consider that is the real added value we can bring to the table. We brought everyone together because we need to ensure that when it comes to a response to a threat, we try to work together to get the best result.” Alexander Nagler, General Manager, Austria & Switzerland at AIG said that 15 years ago cyber insurance was an indemnity solution, and so the protection provided to companies was more limited. “Since then there has been a lot of development, we have listened to our clients and have enhanced the product considerably. This is confirmed by a growing policy count and an increase in notifications under those policies. While we continue to refine our offering, we have a great product. Cyber has evolved to a point where all risk managers should at least evaluate their company’s needs and strongly consider purchasing insurance,” he said. According to Thomas Hürlimann, CEO Zurich Global Corporate: “Ultimately, it is up to the buyer to decide on the value of cyber protection insurance, and we have seen a real uptake over the last ten years. So far, the penetration is quite different in the US compared to the rest of the world. The US is much more advanced because of the regulatory situation. It is also interesting that the penetration varies a lot by industry.” Another insurer on the panel, Andreas Berger, Member of the Board of Management, Allianz Global Corporate & Specialty, told the forum: “This is a topic that is so different to the traditional insurance thinking, and that is why we are at the beginning of a new era. We will see new disciplines coming up in insurance companies, and we will see new definitions as to what products really mean. For example, it is not just the wordings, there are a lot of service elements to it.” Peter Hacker, CEO Global CTM Practice, JLT Group, said: “Insurers are not just stepping up, they are learning quickly that a product is not the right approach. All the leading insurers have made major steps forward, compared with just a year ago. It must be a process that ends in a solution, not working back from a product. We are not there yet but we are heading in the right direction.” Coming from the claims point of view, Benedict Burke, Senior Vice President, Global Markets at Crawford & Co., said: “The Crawford analysis around the claims experience reflects some of the comments we have heard from underwriters—i.e. that cyber and intangible risk is still an emerging insurer proposition. The claim frequencies remain very low, especially outside of the US. However, as capacity and appetite grows, claims solutions will need to be client bespoke and the approach and methodology needs to be pre-planned to be effective.” Cyber insurance—just a commodity? The keynote panel session at last month’s JLT Global Digital Risks & Technology Forum in Salzburg debated the extent to which cyber insurance is simply becoming a commodity. Currently, prices appear to be quite low and competition seems to be increasing. But if cyber insurance is to become a useful and widespread solution for larger companies it clearly needs to add value beyond the financial reimbursement of losses. Peter Hacker, CEO Global CTM Practice, JLT Group, told the forum that while a straightforward product may have value for smaller companies, larger companies require bespoke solutions. “There is a solution process you have to go through. If it is just a commodity, there is no added value, even if it is cheap. Price is secondary because if you buy something that does not fit the purpose, then it is just a waste of money,” he said. Andreas Berger, Member of the Board of Management, Allianz Global Corporate & Specialty, said he believed in ‘the magic triangle’. “You can only underwrite the risk if you understand the risk. So you need loss control engineering, you need to have risk assessment capabilities,” he explained. “So the magic triangle is loss control engineering, underwriting and claims handling. And the lessons learned out of the claims, together with the risk consulting part, that is the essence. When you move into the cyber sphere that is exactly where the added value is, because the products are not just the cover, there are also the risk assessment elements.” He pointed out that insurers are investing in third party resources to help them manage their exposures but also offer value-added services to cyber cover. Therefore insurers are not just selling cyber risk capacity, the added services become an important element of differentiation among providers, he said. Peter Den Dekker, Insurance and Risk Manager, VimpelCom Ltd, responded: “I think that the investments made by insurers are, in many cases, unfortunately in outsourced technology companies, response organisations and consultants, and not so much in their own technology people that know how to assess cyber security and look at regulatory issues. It is a learning process for insurers—they bring in outside parties and that is their investment. That is why the cost of assessing the loss and handling it is going up while the frequency is flat. Insurers should invest a little bit more in their own staff.” Specifically on the issue of cyber insurance becoming a commodity, David Ralph, Senior Vice President, Risk Management, PCCW, asked simply: “What is the problem with it being a commodity? The reason we are seeing pricing going down is that it is reaching the levels where it should be. I think it was over-priced to start with because nobody knew what to expect. We’ve had ten years of looking at claims and they aren’t that big for what the pricing was. The value that we will get out, and what will stop it becoming a commodity, is where it is not just sold as part of an insurance product, but has an assessment process that goes with it, and the participation of the insurers in that process. So, not just an indemnity product, but a service that helps us to enhance our business effectiveness over time.” However, JLT’s Mr Hacker said he wasn’t sure if current pricing is adequate. “Some of the risks we are talking about, especially related to cloud computing, are comparable to nat cat risk. Very few underwriters, if any, and very few brokers, have a full understanding of the aggregation risk with regards to cloud computing,” he said. He went on: “As far as pricing is concerned, it depends on industry and geography. For some companies and regions the pricing is right. But for major corporations, the exposure in terms of frequency and severity has gone up dramatically over the last two to three years. I can’t see it going down over the next few years. So if we want to provide something sustainable, then we have to work very closely together. And if we don’t have the data to underwrite it, the capacity will go quicker than it came in. The understanding and ability to quote the cloud exposure consistently is one crucial factor for a sustainable, added value and long-term solution.” Alexander Nagler, General Manager, Austria & Switzerland at AIG, insisted that the cyber product would continue to evolve. “One of the challenges and opportunities is that every day there are new exposures presenting themselves. It is not possible to anticipate all these trends. The speed at which the digital world is progressing is exciting. The industry will be able to respond to this ever-changing environment, but not overnight. In my opinion, cyber has matured to the point of being an established product demonstrated by significant growth,” he said. Benedict Burke, Senior Vice President, Global Markets at loss adjuster Crawford & Co, pointed to a change of policy wording in many cyber policies. “From a product development point of view, the move to an all risks wording, to include cover for non-physical damage business interruption, will generate more frequency and greater claims complexity. That extension in the coverage is where a lot of the debate has been in the market over the last twelve months. Will the market support that shift?” Thomas Hürlimann, CEO Zurich Global Corporate, told the forum: “In the situation where a risk manager thinks that by buying cyber protection insurance his job is done, he is not doing the best job for his company. More important is the work around understanding the risk, putting risk prevention mechanisms in place and having clear action plans in place in case of a severe attack. A risk manager who has put a combination of all of this in place can make a huge difference as to whether she/he creates value in their company or not. It is the insurers’ and brokers’ role to partner up with the risk managers and share with them risk insights—the experience and knowledge we have created over the last ten years. And the protection piece is just a very small part of that.” Big data, big risks As information technology moves on apace, so do the associated risks. New exposures appear with frightening regularity. The latest buzzword/exposure is ‘big data’. But what is big data? At the heart of big data technology is mathematics, analytics and probabilities. It is about creating value out of data and maximising the potential value of the information. However, according to one of the keynote speakers at the JLT Global Digital Risks & Technology Forum: “You don’t need to have lots of data to have a big data problem to solve.” Mike Merritt-Holmes, Co-founder of Big Data Partnership, continued: “It comes down to variety, velocity and volume. Variety in terms of the type of data, velocity in terms of the speed it comes in, or the speed needed to analyse it, and volume in terms of the sheer size of the data. There is also value—this may be about new opportunities for revenue or reducing risk.” The pioneers of big data were companies such as LinkedIn, Amazon and Facebook. It helped them to really understand how people were using their websites. “They were generating so much data, they had to come up with new economical and scalable solutions and new ways to look at that data. From that they were able to come up with recommendation engines driven by big data technology and using machine learning. They developed these technologies and then open-sourced them,” Mr Merritt-Holmes told the forum. One of the big challenges when it comes to analytics is dealing with unstructured data. Big data technology allows organisations to bring in data in a variety of forms—such as video, email and documents—without the need to try and convert that information into a different format. Mr Merritt-Holmes explained that big data provides tools to enable organisations to analyse unstructured data that was technically and economically extremely challenging to process. “Many companies have a lot of data in silos and the challenge is to bring that data together. Companies spend millions of pounds trying to build a 360-degree picture of the customer, and that can be difficult where the data is in silos. All this data can be brought into a ‘data lake’ and analysed and used together without the need to over manipulate existing systems or processes,” he said. Finally, he explained that big data offers companies the ability and opportunity to analyse and process data in the cloud using open-source software, without having to invest in very expensive hardware. Risks associated with big data include its close association with cloud computing and potentially catastrophic data breaches. According to another keynote speaker at the JLT Forum, Professor Dr Marco Gercke, the move to the cloud can mean additional risks. Professor Gercke, who works as an adviser to different international organisations such as NATO and national governments, as well as big corporations, said that outsourcing to the cloud adds to the risk of insider attacks or illegal access. For Professor Gercke, the trend towards cloud computing is a big risk issue often ignored by decision makers. “Top management can be disconnected from the rest of the organisation when it comes to cyber security,” he explained. And then there is the issue of scale. Professor Gercke said the use of big data technologies amplifies the potential cost of data breaches. Put simply, he said, if the cost of a data breach is around US$200 per data set, then big data represents a substantial multiplier when thinking about the total cost of an event.

Grasping the full potential of cyber insurance

Want to read this article?

Read Next

Helvetia restructures for international growth, adds risk management to board

Switzerland’s Kessler rolls out ESG ratings to pension funds

Alstom becomes latest firm to register French captive

Amrae names new board members

Brazilian states return to court to double dam collapse compensation to $19.5bn

Helvetia restructures for international growth, adds risk management to board

Switzerland’s Kessler rolls out ESG ratings to pension funds

Alstom becomes latest firm to register French captive

Amrae names new board members

Brazilian states return to court to double dam collapse compensation to $19.5bn

Want to read this article?

Read Next

Helvetia restructures for international growth, adds risk management to board

Switzerland’s Kessler rolls out ESG ratings to pension funds

Alstom becomes latest firm to register French captive

Amrae names new board members

Brazilian states return to court to double dam collapse compensation to $19.5bn

Related Articles