Insurers making progress on cyber solutions

Instead risk and insurance managers are focusing on mitigation until fully developed and affordable cyber solutions are on the table. Experts also say that many companies are still struggling to gets to grips with cyber threats and decide who should be in charge of the risk. Cyber risk demands an enterprise-wide risk management approach, they say, and represents a huge opportunity for risk professionals to take oversight of this growing business threat and add value to their organisation. Insurers are responding to the needs of European buyers and beyond that want better cyber risk transfer, measurement and management solutions. Buyers, brokers and insurers alike seem to have grasped the fact that cyber risk is bespoke and demands a bespoke insurance solution, especially for large companies. According to participants of our European Risk Frontiers survey, cyber insurance solutions are improving for European buyers.hideJose Luis Amorim, Risk Manager at Portuguese retail, telecommunications and financial group Sonae, said his firm has scanned the insurance market for solutions and is pleasantly surprised by what it has found. These improvements include added services to help companies measure and manage cyber risks. “We were presented with very comprehensive coverages for cyber risks that we could not find in the market in the past. We are considering whether it is worth taking that road and studying additional coverages that provide interesting kinds of protection, ranging from consultancy on prevention to reaction to crises, including business interruption,” he said. His compatriot Luis Campilho, Insurance Manager at EFACEC, agreed, but noted that price of coverage remains a potential stumbling block. “We have also seen interesting new coverages for cyber risks, but the information that is still missing is how much they will cost,” he said. German risk and insurance managers from DVS’ committee that took part in our European Risk Frontiers survey said there is still room for improvement in cyber insurance, but agreed that the insurance market is responding positively to buyer demands. They noted that the enterprise-wide nature of cyber risk means that off-the-shelf products do not work for larger and more complex organisations. The German and Portuguese risk managers are in agreement that insurers must ensure transfer solutions with a range of IT experts to help companies get to grips with cyber risk. “I am urging insurers to make it standard to have loss prevention engineers for cyber just as it is for fire. We are economists and, on average, probably last about three minutes in a discussion with the IT department and it must be the same for insurance companies. They need to hire real experts to handle this,” said Klaus Braukmann, Head of Insurance at Continental AG. Sonae risk manager Mr Amorim said several companies have devel-oped such expertise but large ins-urers now also offer these services. “They want to do their own assessment, which boosts prevention as they are able to test the IT defence systems implemented by their clients, detect possible attacks that have already taken place and suggest measures to boost defences,” he said. So it seems insurers are listening to buyer demands for broader and more bespoke cyber cover and improved value added services. According to Matt Cullina, CEO of identity theft and data breach prevention company IDT911, insurers in the US are now offering up to half a billion dollars in capacity for cyber risk. Coverage has become much broader in the last 18 months, he continued, with around eight different types of coverage now offered under most cyber policies. “There is a growing sophistication. It is still early days but carriers are getting smarter and smarter. If the big insurers are offering $400m in limit to a single insured they are getting more confident based on information they are getting about the risk,” he said. He pointed out that while it has taken 15 years for cyber products to develop in the US and become a mainstream coverage for insureds, it has taken just five years to get to a similar point in Canada. The hard work carried out in the US means that the European cyber market will develop much more quickly, he argued. “It is still ramping up in Canada but it has been much more quick to develop. We think the same thing is going to happen in Europe. As lessons are learned in other places and it becomes more of a mainstream coverage, and there is a more knowledgeable approach with the broker community much more involved, we think it will ramp up here pretty quickly,” he said. European insurers are in the process of building out networks of IT specialists to help insureds measure their cyber risk, deal with the consequences and decide on the best balance between mitigation and risk transfer, he continued. “In Europe, what we have heard from carriers that do business internationally and sell cyber in the US is that they are still trying to identify their network of experts. So it is more fragmented and less certain but they are trying to form groups of legal experts, forensic experts and the like country-by-country,” said Mr Cullina. “It is all early days but this is going to happen here, there are going to be experts in play. For these types of products these services are almost a must. It’s what the insureds want and it’s how the brokers sell the programme. So the need is there and the demand is there and it is just a matter of time to get the right people in place,” he added. He noted that for large clients, risk carriers will tend to offer a panel of experts. “The larger companies usually have their own stable of experts or they want choice and a selection from insurers,” he said. Last month’s announcements that both Munich Re and Swiss Re’s primary businesses have teamed with IT specialists to help clients manage cyber exposures, reflects growing sophistication at European insurers. Munich Re has partnered with technology firm Hewlett-Packard (HP) to help clients better assess their digital risks and find the best balance between mitigation and transfer. Working under Munich Re Corporate Insurance Partner’s new cyber solution—Digit@ll—the deal will see HP assess companies’ specific digital risks to help them decide whether to bolster IT mitigation and security, take out insurance or both. Nils Diekmann, Cyber Risk Underwriter at Munich Re, said Digit@ll’s cooperation with HP will better allow companies to ‘decide on defensive measures for minimising risk and then buy only the insurance cover they really need’. Digit@ll works under a modular system in an attempt to offer the bespoke solutions that large buyers demand. “Based on a joint workshop with our clients, we are conducting an individual technical risk assessment, followed by the development of a bespoke insurance solution and risk-mitigation recommendations. This addresses the client’s cyber risk situation as a whole,” said Mr Diekmann. Meanwhile, Swiss Re Corporate Solutions has teamed with IBM to provide ‘advanced cyber risk protection products and services’ to companies worldwide. Under the deal, IBM will assess Swiss Re’s clients’ external and internal vulnerabilities to cyber attacks, giving them options for implementing risk mitigation proposals. However, while progress is being made on cyber risk transfer solutions in Europe, more needs to be done, experts agree. Until solutions develop further, many European risk and insurance managers are focusing on mitigation efforts rather than taking out insurance. Aon’s 2015 Global Risk Management survey, released at the end of April, reveals that only 10% of European respondents said their organisation has purchased cyber coverage. This compares with 42% in the US. 73% of European respondents said they have not purchased cyber coverage nor plan to do so. This suggests that European buyers are still not fully comfortable with cyber covers on offer. Rory Moloney, Chief Executive Officer, Aon Global Risk Consulting, said that buyers, brokers and insurers are still working to ‘get their heads fully around cyber risk’. “We are seeing that a lot of resources are going into the understanding of cyber risk and mitigation but we have a little way to go before we can get a fully effective hedge and solutions,” he said. He also said that market progress is made difficult by the fact that cover needs to be bespoke. “For one organisation the exposure might be all about third party but for others it might be business disruption. That’s not generic for a market to deal with so today we are seeing low levels of capacity and a cautious approach from the market in response to cyber cover,” he said. The recent Aon survey also ‘alarmingly’ reveals that globally only 42% of respondent firms have completed a cyber risk assessment. This number falls to 37% in Europe. In the US the figure stands at 57%. “Given the frequency and prevalence of cyber risks, it is alarming that a fairly large percentage of companies—58%—have not completed a cyber risk assessment,” said Aon on the findings. One reason for this may be that many companies are yet to decide how to manage cyber risk and who exactly should be in charge. The risk and insurance managers, brokers and industry experts that we have spoken to agree that this represents a business threat but also a huge opportunity for risk professionals to grasp the nettle and take control of cyber as part of an enterprise-wide approach. IDT911’s Mr Cullina said that companies must decide who is in charge of cyber risk oversight. That individual needs to be independent from IT and bring all the stakeholders together. “This is the biggest conundrum for companies. The IT folks serve a role but they shouldn’t be overseeing information security practices. They should be at the table but not in charge. Companies must decide whether to hire a privacy officer and use a compliance approach or handle all this within the risk management department and strategy. That person needs to have independence. You need to have somebody that is reporting to C-suite level, that is in charge of risk and information security governance and is liaising with IT and the business. A communal approach is needed, but you need to have independent centralisation as well in all this,” he said. Grant Foster, Head of Enterprise Risk Management at Aon Global Risk Consulting, said cyber risk management clearly requires a broader approach than leaving it to the IT department. It is an enterprise risk and should be managed as such rather than in silo, he said. “Its no good saying to the IT guy cyber is your problem because it is an enterprise problem. Giving responsibility to one guy who just knows about computers isn’t enough. The silo approach isn’t enough to manage the risk, so for cyber, enter-prise risk management is the way forward,” he said. “You actually need somebody at a slightly higher level putting the risks into a business perspective and that is where we spend most of our time helping clients.” Leading risk managers are clearly in agreement and urge their colleagues to get involved with cyber risk. As Jörg Henne, DVS Committee Member and Insurance Manager at EPCOS AG, said: cyber is a learning curve for the whole market but actually represents a good opportunity for risk and insurance managers to step up and fill a corporate void. “This is a chance for us to fill a blank spot…There is a chance here to own this risk,” said Mr Henne.

Insurers making progress on cyber solutions

Want to read this article?

Read Next

AstraZeneca places innovative outcomes based policy that covers interconnected risks

40% of ESG investment funds in Europe accused of greenwashing

Talanx brings forward targets in new sustainability strategy

German insurers brace for rising fraud cases

FM Global reveals record $1.4bn renewal credits

AstraZeneca places innovative outcomes based policy that covers interconnected risks

40% of ESG investment funds in Europe accused of greenwashing

Talanx brings forward targets in new sustainability strategy

German insurers brace for rising fraud cases

FM Global reveals record $1.4bn renewal credits

Want to read this article?

Read Next

AstraZeneca places innovative outcomes based policy that covers interconnected risks

40% of ESG investment funds in Europe accused of greenwashing

Talanx brings forward targets in new sustainability strategy

German insurers brace for rising fraud cases

FM Global reveals record $1.4bn renewal credits

Related Articles