Mactavish to publish detailed evidence on cyber flaws in bid to spark market

Mactavish has told CRE it will publish detailed evidence of its research that identified common problems in cyber policies, reiterated calls for insurers not to deny claims because of such issues, and again invited the market to join an open debate on the state of cyber cover. The move by Mactavish is the latest twist in a saga that began late last year when the company published a paper listing eight flaws it found in cyber policies, following analysis of the London and UK market. Brokers and insurers denied the flaws exist. So, in an open letter, Mactavish challenged themto state publicly that no claims will be rejected because of these problems. In response, the Association of British Insurers (ABI) said it simply does not recognise the flaws raised by Mactavish, and challenged the company to share proof of any problems. The association believes Mactavish has “fundamentally misinterpreted” how cyber insurance works in its analysis of market offerings. The ABI did not commit its members to not denying claims based on the issues raised by Mactavish. Neither has it responded to an invite from the company at the end of March to join an open debate on cyber insurance. Huw Evans, director general of the ABI, wrote a letter to Mactavish’s CEO Bruce Hepburn stating: “We do not recognise your description of the ‘flaws’ in cyber polices, nor do we believe these are systemic or widespread issues across the market. “While it might be the case that there are a small minority of policies that have some of the more basic coverage aspects you imply, in practise these are almost always sold with an extension or endorsement which increases the baseline coverage significantly,” he added. The ABI believes Mactavish has fundamentally misinterpreted the fact that cyber insurance works on this basis. And Mr Evans called on the company to put its money where its mouth is and hand over proof to back up its claims. “I would request that you share the details of your policy analysis if you have true evidence of a problem here,” he wrote. Mactavish has taken up this challenge. Its CEO Mr Hepburn told CRE it will now publish a raft of evidence to support its claims. “Firstly, I would point out that we know we are going to get attacked so we don’t publish anything for which we don’t have evidence,” he said. “So, in response to the ABI and others we are going to produce this new evidence in the form of a report. It will be packed with evidence and extraordinarily challenging,” Mr Hepburn added. The report is in production and will likely be published in early May. In addition to publishing its evidence, Mactavish is again calling on the insurance market to make a commitment not to deny cyber claims based on the identified flaws, and join an open panel debate. Mr Hepburn believes it would be perfectly “plausible” and “reasonable” for the insurance market to commit on claims unless it can be proved that the insurance buyer declined to take out fully explained, bolt-on cover, via extensions or endorsements. “This seems a simple solution. I don’t see why the market cannot make a statement that says no cyber claim will be denied in our industry for one of these eight reasons. The exception could be if the market can show a piece of paper produced by the broker that proves a bolt-on was offered and declined by the customer following provision of advice as to what the bolt-on was,” he said. “Why can’t they do that? It is perfectly plausible to say: here is our commitment to doing a job, particularly for our most important customers,” he added. Mr Hepburn said neither the ABI or the British Insurance Brokers’ Association has responded to an invitation from Mactavish to join a panel or public event on the state of the cyber insurance market. So Mactavish is extending the invite once more. The eight flaws in cyber policies found by Mactavish are: Cover can be limited to events triggered by attacks or unauthorised activity – excluding cover for accidental errors or omissions Data breach costs can be limited, only covering costs that the business is strictly legally required to incur Systems interruption cover can be limited to only the brief period of actual network interruption and not the knock-on revenue impact in the period after IT systems are restored but the business is still disrupted Cover for systems delivered by outsourced service providers varies significantly and is often limited or excluded Exclusions for software in development or systems being rolled out are common and can be unclear, or in the worst cases, exclude events relating to any recently updated systems Where contractors cause issues (eg data breach) but the business is legally responsible, policies will sometimes not respond Notification requirements are often complex and onerous Businesses must choose IT, legal or PR specialists appointed by their insurer. Mr Hepburn said most of the policies Mactavish has looked at were in place for “substantial” businesses. He believes the problems raised are particularly acute for large buyers. “In the SME segment, every year insurers update the policies and reissue them. The big corporates are onto that and don’t let the wordings change every year. Now the insurance market has said [the] problems we have raised were only in previous years’ wordings. Well, the large corporate may well have decided to keep the same wording unless someone has told them things have improved. Well, often no one tells them. So they get left behind and face the problems we have identified,” said Mr Hepburn. He also tackled some of the other responses he has faced from insurers in reaction to Mactavish’s cyber research. “They say some of the problems used to be in cyber polices but are not now in policies of leading insurers. Well, who are the leading insurers? They are not saying the flaws don’t exist. We are saying buyers should be vigilant because these flaws exist,” he said. Adding: “They also says clients will have cyber cover on PDBI, PI, D&O or crime and then they can buy standalone cyber. When these cyber claims get denied – such as in the Mondelez case – they say it wasn’t a cyber policy, as if that is not a cyber insurance problem. If you have negotiated with your broker that you will have these risks on a cyber policy, but others are covered by your PDBI policy, then you have bought cyber insurance. To argue that isn’t part of the cyber market is ridiculous.” Meanwhile, Ferma says it is concerned about a proposed ISO standard for cyber insurance that aims to standardise cover and provide guidelines for IT professionals wanting to transfer the risk.

Mactavish to publish detailed evidence on cyber flaws in bid to spark market

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles