JLT launches cyber attack simulation tool to grab CEOs attention

It aims to help risk managers grab the CEOs' attention on cyber risk. The unique solution could bring the very real stresses of a cyber attack to their attention and help establish the risk landscape facing their organisations. Professor Gercke said the tool should help bridge the gap between top management and the rest of the organisation when it comes to cyber security. "Top management is currently not really involved-this needs to change. A new approach needs to be taken to change the mindset of the CEO," he said. The simulator places CEOs in control of a cyber attack and asks them to make decisions in real time. It provides a realistic, interactive experience in which CEOs are confronted by a series of escalating incidents that reveal the consequences of their decisions. Importantly, it is not about testing technical skills but management decisions and strategies.hideThe simulation could be a useful tool for any corporate risk manager attempting to get management to focus on cyber security, especially when it is tailored to the company and allows the CEO to 'plug and play' with their own scenarios. Professor Gercke said that the simulation 'goes beyond words'. He added: "Although it is possible to talk to CEOs about the threats, it is not particularly effective. They need to feel it." Peter Hacker, CEO Global CTM Practice, JLT Group, said that part of the problem when dealing with cyber risk, or intangible risk, is that it is looked at from the 'bottom up' of an organisation rather than the 'top down'. "And it is often looked at in an isolated way, vertically rather than horizontally. In other words, if there is a breach in one area, there will be consequential losses, such as contractual liabilities, brand impact and reputation," he said. How can you then make insurance an asset rather than just a commodity? "Understanding the risk, identifying and quantifying the risk and treating the risk in a sustainable way," said Mr Hacker. "Then insurance can be an asset and not just a commodity." The simulation approach is linked to JLT's IPI Plus (Intangible Protection Insurance with non-physical damage business interruption). "With traditional insurance, when people talk about cyber risk, they talk about privacy risk and network security risk. Within IPI Plus, we are talking about technology E&O, intellectual property and cyber risk first and third party. It is a combination on an all-risks basis," said Mr Hacker. But ultimately, he said, insurance is just the cherry on the cake. "What is relevant is a solution with a number of steps: you need to understand your risk landscape and you need to quantitatively identify what you can lose. Then you can understand what remains and look at how to transfer that risk to a third party." He said the simulator comes at the problem from the angle of 'what is the risk landscape' rather than from the angle of an insurance product. As the simulation can be customised to the individual corporation, so can insurance solutions. Insurance must be bespoke and cannot be replicated across sectors or regions, said Mr Hacker. "We use the simulation tool to show the impact that the threats can have, demonstrate the risks that are out there and highlight the vulnerabilities and weaknesses of available products," he said. "But above all, we use it to increase awareness of the need for an end-to-end solution. We are not coming from the product end. The end-to-end-solution includes risk identification, risk transfer and, importantly, the claims solution. It covers pre-agreed incident responses, pre-loss stress testing, forensic accounting and transfer mechanisms." In other words, he said, it is an integrated solution that is unique in the risk transfer market. Professor Gercke added that while risk professionals can readily appreciate the scale and source of a potential cyber loss, the same cannot always be said of management in the C-suite. Frequently, the C-suite doesn't know who has responsibility for cyber security, let alone the possibility they might be held ultimately responsible when a serious event happens and their share price plummets. A real life, interactive scenario might just open their eyes to the true risks and enable C-suite buy-in.

JLT launches cyber attack simulation tool to grab CEOs attention

Want to read this article?

Read Next

Helvetia restructures for international growth, adds risk management to board

Switzerland’s Kessler rolls out ESG ratings to pension funds

Alstom becomes latest firm to register French captive

Amrae names new board members

Brazilian states return to court to double dam collapse compensation to $19.5bn

Helvetia restructures for international growth, adds risk management to board

Switzerland’s Kessler rolls out ESG ratings to pension funds

Alstom becomes latest firm to register French captive

Amrae names new board members

Brazilian states return to court to double dam collapse compensation to $19.5bn

Want to read this article?

Read Next

Helvetia restructures for international growth, adds risk management to board

Switzerland’s Kessler rolls out ESG ratings to pension funds

Alstom becomes latest firm to register French captive

Amrae names new board members

Brazilian states return to court to double dam collapse compensation to $19.5bn

Related Articles