Is cyber risk becoming uninsurable?

Risk managers in Belgium say the question about whether some risks can remain insurable is beginning to reach board level.

Taking part in our Risk Frontiers Europe 2022 survey, the group said cyber risk insurance is the biggest area of concern.

Bart Smets, head of insurance and risk at Umicore, was among those who said that overall, the last round of renewals was not as tough as in the preceding two years. However, cyber cover was the outlier as it was still immensely difficult to find the right cover with the right capacity at the right price, said Smets.

“For the most part, the last renewals were okay. Rates for most of the programme seem to be more stable than in the past two years and we achieved what we needed with either the same prices or maybe a 5% increase. On certain lines, we now have higher limits. Overall, it was a very positive process but we were making more use of our captive to achieve that,” he told CRE.

Smets is hopeful that prices will either soften a little or stabilise further this year. “For certain lines, particularly property and liability, I think they have reached the maximum that they can in terms of increases,” he said.

CYBER CONCERNS

However financial lines were not so easy, in particular cyber, he continued. “Cyber remains a big problem. We are beginning to have questions about whether cyber can remain an insurable risk at all,” he said.

His words were echoed by others in the group. Frédéric Lycops, corporate risk and insurance manager at Recticel, was among them. “I have had discussions internally about whether cyber will continue to be an insurable risk,” he said.

The risk is that the cover will become too expensive, even if companies can access the capacity they need. Buyers are already seeing prices rise for much less cyber cover. The question has become whether or not they can manage the risk internally without having to rely on insurance.

Some of the group felt there will be more money spent on cybersecurity to negate the need for insurance, while others felt they would buy what they could afford and use insurance as a true last resort.

TOUGH QUESTIONS

Whether insurance remains relevant and cost-effective is one of the big questions that risk managers and their boards have been addressing during the past couple of years.

Most risk managers have faced tough questions from their boards about the cost of insurance and whether it is worth the investment as prices rose in the hard market. The risk managers admitted it has left them with a sour taste in the mouth from the whole experience.

And they are not out of the woods yet. Marie-France Theys, corporate risk and insurance manager at Schneider Electric, remains disappointed by the changing level of decision-making from insurers.

“We are still being kept at a distance from the decision-makers within the insurance companies. It is much easier for an insurer to refuse your coverage when they are working at such a distance. The relationships we have with local offices have not been lost but the ultimate decision to cover or not is beyond their control,” she said.

“It also means there is a lack of real understanding of what we are about, how we manage our risks and what we need form the insurer,” she added.

Nathalie Vandenbroucke, insurance, risk and compliance manager at Eiffage in Benelux, summed it up: “If you think what we went through in the past two years as risk managers, we were getting hurt from our boards and pressure from insurers. But we have an opportunity to think about risk and transfer in different ways and also to think more deeply about prevention.”

WHOLE PACKAGE

That brought Lycops onto the subject of what insurers could do to better serve their clients.

“It is not just about pricing but about the whole service package. They could be using new technology to assist us with loss prevention, among other things,” he said.

Smets added: “They need to invest in technology – but for their own sake. As an insurer, they need to evaluate the risks better. But as insureds, we also need to take control of this and own the information that we have. We need to be able to explain to insurers what we need and to be able to argue why they should be involved with these risks.”

None of the risk managers are expecting anything but tough times ahead and they acknowledge that there will be more seismic shocks, either within Belgium, Europe or on the global stage.

They are disappointed that discussions on things like pandemic pools appear to have fallen by the wayside without anything concrete being achieved. They said efforts early in the pandemic appear to have come to nothing and there is concern that nothing will be done until the next crisis.

The group agreed that part of the risk management role is to think ahead and not just fire-fight once the blaze is alight. There was also a feeling that some of the emerging risks are becoming simply too big for any one organisation to handle.

They believe that going forward, governments are going to have to step up with more than short-term debt solutions, free loans or moratoriums.