London market responds to silent cyber concerns

The London market is responding to regulatory pressure to clarify cyber cover under traditional insurance policies, with implications for buyers of specialty insurance that have seen an increasing number of exclusions written into contracts while being offered more extensions. In July 2017, the UK’s Prudential Regulation Authority (PRA) issued Supervisory Statement SS4/17 setting out its views on ‘silent cyber’ cover, also known as non-affirmative cover, where traditional insurance policies could respond to cyber losses. The statement marked a gear-change in regulatory oversight from the PRA, which is now encouraging insurers to clarify where and to what extent cyber cover is provided in insurance policies. In particular, the PRA’s Supervisory Statement called on insurers to identify silent cyber exposures, and to accordingly adjust premiums, limits and/or use “robust wordings”. The PRA also called on insurers to produce cyber risk appetite statements and increase their cyber technical expertise. More than a year on from the Supervisory Statement, the London insurance market has taken a number of steps to address the PRA’s concerns. The two main market bodies, the Lloyd’s Market Association (LMA) and the International Underwriting Association, have been working to develop model wordings and produce analysis of cyber cover under traditional policies. Lloyd’s has been challenging the market to tackle cyber risk for more than five years, but increasingly the pressure has been coming from the PRA, explained Mel Goddard, market liaison and underwriting director at the LMA. The regulator is actively pushing the market to clarify cyber coverage and manage exposures in traditional policies, she said. Analysis of traditional insurance policies across almost 40 classes of business by the LMA showed that many written at Lloyd’s have forms of cyber exclusions, and that the market is moving to clarify cover by using these exclusions, drafting new exclusions or providing cover using affirmative language. In most classes, cover for physical damage losses, malicious and/or non-malicious cyber incidents were found to be excluded, although limited write-backs are being offered. However, for non-marine liability classes, the study found cyber cover is available for a wide range of legal liabilities, with few exclusions. Cyber is a broad area of work for the LMA, and will require an ongoing review of policies to clarify cover available under existing language, introduce or amend exclusions and potentially extend cover through write-backs or standalone affirmative language. This year, LMA committees have published model cyber clauses for use in aviation, property reinsurance, personal accident and specie markets, as well as updated cyber language in the international general liability wording. Work has also started on drafting a write-back clause for cyber cover in the terrorism market. This does not mean, however, that insurers are systematically looking to limit cyber cover under traditional policies. A number of the new clauses include write-backs and the LMA’s review reveals varying degrees of cyber cover under property and liability policies. In some markets, insurers appear comfortable accepting cyber exposures, as long as they do not present potential systemic losses. For example, the aviation market issued model wordings earlier this year that would exclude losses from data breaches and IT system outages. But the market seems content to cover airline accidents under hull and liability policies that arise from cyber incidents, at least for now. “In many cases, in existing classes of business we see old perils manifesting in new ways, such as a fire or explosion caused by a cyber incident. In the aviation market, historically a loss might be caused by pilot error, while today the trigger could be a technical malfunction,” said Ms Goddard. However, systemic cyber exposures in traditional insurance policies are of greater concern to insurers and regulators, particularly given the nature of cyber risks – which are not necessarily geographically or temporally restricted. “The insurance market is prepared to move with the times, but the particular challenge is to understand catastrophic and systemic losses. As such, CROs at Lloyd’s managing agents are working hard on creating a framework to analyse their portfolios and where hotspots might lay,” said Ms Goddard. There is work at market level to understand systemic risks better in certain sectors. For example, a recent paper from the London market Joint Rig Committee (JRC) identified the potential for systemic vulnerabilities in the oil and gas sector. “There is considerable analytical work in progress in the market, which should put insurers in a better position to monitor and manage accumulation risk and buy reinsurance appropriately,” explained Ms Goddard. While market initiatives like LMA model wordings can help clarify cyber coverage under traditional policies, it remains a commercial decision as to whether such clauses are adopted. “The LMA supports managing agents with class-of-business analysis and model wordings, but it is for the individual businesses in the market to find the level of cover that they are willing to give and respond to the regulator on the rationale for these decisions,” said Ms Goddard. Soft market conditions can make it harder for underwriters to clarify coverage because brokers and clients are able to resist changes to wordings. At present, the London market appears to be caught between the PRA pushing for greater clarity, and brokers that argue against any perceived restriction or alteration in cover. Another way in which insurers are clarifying cyber cover in traditional insurance is through specific cyber extensions. Increasingly, insurers are partnering underwriting teams with their standalone cyber insurance expertise, ensuring there is input from exposure management and risk teams. This trend seems to be in line with the desire of regulators. The PRA has called for insurers to have “sufficient expertise to understand the risks associated with cyber insurance underwriting”. “There is a real emphasis in the market and by the PRA on access to knowledge and expertise on how cyber risk manifests itself,” said Ms Goddard. XL Catlin, for example, recently developed a coverage extension to its UK general liability product that provides cyber insurance for mid-sized and large companies that do not currently buy standalone cyber cover. The endorsement essentially adds first-party cyber and business interruption to UK general liability policies. This year has also seen brokers and insurers develop cyber extensions for other lines of business, or to wrap around multiple policies aimed at specific industries. For example, a number of brokers are offering airlines cyber insurance to cover data breaches and IT outages, which are excluded from traditional aviation hull and liability policies. Perhaps the biggest driver of change in cyber wordings within traditional insurance will be losses. Last year’s WannaCry and NotPetya malware attacks, for example, caused some buyers to focus on cyber cover under traditional policies, as well as consider additional cover from the cyber insurance market. “What often moves a market is the challenge created by having to respond to clients suffering losses. There is nothing like the manifestation of losses to drive the understanding of a product and demand,” said Ms Goddard.

London market responds to silent cyber concerns

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Related Articles