Pool Re to put systemic cyber pool proposal to UK government

Pool Re is to present proposals for a systemic cyber insurance pool to the new UK government in the next few months, according to Chris Yeates, senior strategy advisor at the UK terrorism reinsurer. The update on plans for a UK cyber backstop was part of a panel debate at the Ferma Forum, in which participants discussed the wider need for government intervention in the cyber insurance market to cover systemic risks and boost penetration levels, which are particularly low among small companies. According to Yeates, Pool Re started covering limited cyber terrorism risk in 2018 and has since been in discussions with the market on potential public private partnership (PPP) solutions to cover systemic risks. Last year, Pool Re published a study to understand the drivers of cyber under-insurance among both large corporates and SMEs in the UK. Large corporates face challenges buying adequate limits and exclusions for some of the risks they are most concerned about, such as state-sponsored activity and critical infrastructure, said Yeates. “We have designed two schemes to address the two camps of supply and demand. On the SME side we have what you can call a safety net. Essentially funded through insurance premium tax, every SME will have access to cover for a classic systemic cyber event, with a quick fixed payout. For those buying cyber insurance, there would be a more sophisticated pool, modelled on Pool Re, to provide back-to-back cover… to increase limits and free up capital,” explained Yeates. The insurance market has been broadly supportive of Pool Re’s proposals, albeit with reservations around the proposals for SMEs, he added. “Following consultation with more than 50 insurers and trade associations, nobody said ‘why are you doing this?’. There were some reservations around the SME scheme – people were less comfortable with that – but we think it is important to have it on the table when we approach the government to say ‘we have something for small businesses, not just big businesses’,” he said. “We have tweaked the proposals and the working group is happy. They are now ready to test them with the new British government, which we will be doing over the next couple of months,” he said. Yeates was, however, conscious that some in the insurance industry may be wary of government intervention in the cyber insurance market. “People can be scared by intervention. Because what we are talking about with pools is government intervention. And people can get alarmed by that, and that is justifiable in many ways, given that some pools have caused unintended consequences. But we have come such a long way in our understanding of these types of programmes… so I think we can design this in a way that is complimentary to commercial factors,” said Yeates. Pool Re has established three principles for the design of any cyber PPP solution. A cyber PPP should not “get in the way” of anything the private market is either currently doing, or aspires to do, and must be able to respond to changes in market appetite, explained Yeates. Second, it needs to be linked to an overall increase in cybersecurity, such as minimum standards of cybersecurity. Third, a scheme needs to pay out quickly. “We need to ask why are we waiting for market failure to happen before we try to do something about it. Why are these pools plan B? We need to start saying they should be plan A. They need to be part of the way we think about these risks, part of insurance innovation, and part of the way risk managers and businesses can get the cover they need in partnership. We need to ask ‘how can we design something now that will reinforce, not replace, what we have at the moment?’,” said Yeates. Petra Hielkema, chairperson of the European Insurance and Occupational Pensions Authority (Eiopa), also hopes it will not require a large cyber catastrophe before governments look to address the cyber protection gap. However, she noted that a sense of “urgency” is required to get the attention of governments, as is the case currently with natural catastrophes. But she seems less convinced that we are at that stage with cyber. “The question is ‘how do you reach that dialogue on cyber [protection gaps] before it gets too much?’. And that is difficult,” she said. “The first step is to build resilience, and then provide good simple products, backed by reinsurance capacity.” “Then you will get to public private partnerships. You need to move on [these three]; just focusing on PPP will only work if there is a major urgency, which, fortunately, is not yet there,” she said. The CrowdStrike outage in July was a “wake-up” call for the insurance industry and was the first time the market had experienced a systemic cyber event, according to David Molony, head of cyber solutions for Aon's EMEA practice. While there have been claims from CrowdStrike, he believes that insurance market losses will be “nowhere near” the original estimates of $1.5bn to $2bn. “We are in the position now where this market has to fight for relevance and to be able to demonstrate future protection. The CrowdStrike outage is a remarkable example of the overall maturity and response of the market,” he said. The CrowdStrike outage also highlighted a lack of understanding of systemic events and accumulation of risk, according to Jürgen Reinhart, chief underwriting officer for cyber at Munich Re. “CrowdStrike shows how nervous everyone is… That indicates to me that there is not a high level of confidence in our ability to manage accumulations,” he said.

Pool Re to put systemic cyber pool proposal to UK government

European cyber backstop not imminent

Want to read this article?

Read Next

APAC firms lead the way in ESG incentive plans

Australia updates earthquake hazard assessment

Indian insurance market to lead global growth: Swiss Re

Wefox transfers run-off portfolio to Darag

SRS Altitude expands into North American market

APAC firms lead the way in ESG incentive plans

Australia updates earthquake hazard assessment

Indian insurance market to lead global growth: Swiss Re

Wefox transfers run-off portfolio to Darag

SRS Altitude expands into North American market

Keep yourself informed

Sign up for Commercial Risk’s newsletters

Want to read this article?

Read Next

APAC firms lead the way in ESG incentive plans

Australia updates earthquake hazard assessment

Indian insurance market to lead global growth: Swiss Re

Wefox transfers run-off portfolio to Darag

SRS Altitude expands into North American market

Related Articles

Keep yourself informed

Sign up for Commercial Risk’s newsletters