Skills shortage holding back cyber insurance market

A shortage of cyber expertise is curtailing growth in the cyber insurance market, experts warn. The annual cost of cybercrime is estimated at $6trn and three times the average annual cost of natural catastrophes, according to Rory Egan, senior cyber actuary at Munich Re. But while nat cat risks are widely covered by insurance, cyber risk remains largely uninsured, he said at Advisen’s Cyber Risk conference in London. According to Mr Egan, less than 5% of annual cybercrime losses are currently protected by insurance. Worldwide cyber insurance premiums are estimated at $5bn, growing at 20% year on year, or 50% excluding the US, he continued. But uptake of cover could be far greater if insurers were not “stifled” by a limited understanding of the risk compared with traditional lines of insurance, he said. If insurance buyers, underwriters, brokers, cybersecurity professionals and service providers work together and share their expertise, the industry can “rise to the challenge”, argued Mr Egan. “We need each other’s help to understand the legal and risk implications [of cyber],” he said. Also speaking at the event, Michael Paisley, CISO at a payment card processing company, said that a dearth of cyber expertise is an issue that affects insurers and their clients. “There is a wider problem of cyber expertise being available across industries. The underwriting process is positive, but there are insufficient people and expertise,” said Mr Paisley, speaking on a buyers' panel debate. For example, the questions asked by insurers as part of the risk assessment process are not “insightful”, said Mr Paisley. His company carries out loss-scenario exercises but insurers do not ask about this, instead simply asking if the organisation follows best practices. But Mr Paisley believes technological solutions may be able to help overcome limitations in cyber expertise. The past five years have witnessed a dramatic change in the cybersecurity market, with the development of data and risk analytics tools. However, such tools have their limitations and are no “panacea”, he said. Another participant on the buyer panel, Stephen Porter, vice-president of insurance and treasury at Pearson, noted that insurers may be focusing too much on the General Data Protection Regulation. About two thirds of the questions asked by insurers are related to liability and only one third to business interruption, he said. A lack of expertise among brokers is a particular problem highlighted by the panel debate on insurance market trends. “The lack of understanding and education is a major hurdle to buying cyber insurance outside the US and UK. Clients are thirsty for the product, but brokers fear talking about issues they do not understand,” said Shay Simkin, global head of cyber at Howden Insurance Brokers, who moderated the panel debate. When it comes to cyber, retail brokers are too aligned with the US cyber insurance market, according to Alex Jomaa, underwriter of enterprise risks at Tokio Marine Kiln (TMK). He is also critical of brokers that do not cross-sell and leverage expertise that exists within their organisations across different lines and sectors. The lack of cyber expertise and knowledge may also be deterring capital from entering the cyber insurance market, according to Ian Newman, global head of cyber at reinsurance broker Capsicum Re. “There is a knowledge gap. A lot of people want to invest in insurance and there is a lot of enthusiasm for cyber, but a lack of expertise and [an] inability to quantify exposures is putting off the supply of capital,” he said. Several of the participants also blamed a lack of progress on the insurance market’s distribution model, as well as an inability to articulate the value of cyber insurance and tailor the product to local markets. Insurers need distribution models for cyber products that reflect the needs of each market, according to Tom Spier, director at CyberScout, a specialist cyber broker. “It feels like there is a problem with the distribution model. The ability to articulate the value proposition and education around the world is difficult,” he said. “You need a different model for emerging markets. You should not take the US model as the Holy Grail – this is one of the mistakes made in the cyber market right now,” he added. According to TMK’s Mr Jomaa, cyber insurance is too often sold on the US model of privacy cover, and not enough attention is paid to business interruption exposures and coverage.

Skills shortage holding back cyber insurance market

Want to read this article?

Read Next

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Consultancy S-RM expands cybersecurity practice to APAC

Four in five non-EU companies to align with CSRD

Multinational corporate client practice launched by Crawford

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Consultancy S-RM expands cybersecurity practice to APAC

Four in five non-EU companies to align with CSRD

Multinational corporate client practice launched by Crawford

Want to read this article?

Read Next

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Consultancy S-RM expands cybersecurity practice to APAC

Four in five non-EU companies to align with CSRD

Multinational corporate client practice launched by Crawford

Related Articles