Supply chain cyber security ‘without doubt’ biggest challenge, says Marsh

Supply chain security is the biggest challenge for cyber insurance buyers, said Marsh in a recent media briefing in London, when it also predicted rates will continue to fall next year. Discussing the state of the cyber insurance market, Marsh’s UK cyber leader Kelly Butler said supply chain vulnerability to cyberattack is “without doubt” the biggest challenge facing clients today. Gareth Bateman, cyber growth leader for the UK at Marsh, said supply chain risk needs careful attention through due diligence applied to all parties companies work with. “At a big complex organisation with thousands of suppliers, you have to be very good at organising and understanding how you manage those third parties that service your business. You have to target your limited resources to protect the ones that mean the most to your organisation,” he said. Butler said Marsh is working with clients to make sure they are conducting thorough risk assessments and implementing multi-factor authentication (MFA). “It surprises me that we still need to bring up MFA,” she said. Butler stressed the importance of strong vendor management, urging companies to carry out due diligence about who their suppliers are and what they do. Buyers have welcomed rate decreases in the cyber insurance space this year. And Marsh anticipates that rates will continue to fall into 2024. Serena France-Hayhurst, cyber placement leader at Marsh, said its global placement team saw average cyber insurance rates drop 8% in Q3 2023 for UK and international business transacted through London, including primary and excess layers, with rate decreases now into double digits across its portfolio. France-Hayhurst said cyber insurance is “at a stage where markets are happy with the pricing of risk”. Cyber underwriters, who have a couple of profitable years under their belts, are much more comfortable with client risk controls that brokers are bringing to market, she said. Marsh’s clients undertake self-assessments, which insurers are keen to incorporate straight into their rating models to speed up quotes. France-Hayhurst said risk managers are using their savings on cyber insurance to buy more limits, broaden coverage and invest in claims teams. Cyber is a growth area for insurers, France-Hayhurst said, which bodes well for rates. “We do expect rates to continue to decrease into at least halfway through next year,” she said. But she did note some concerns around some sizeable notifications going into the cyber market in the third quarter of this year. Catastrophic risk also continues to loom large over the cyber insurance market, with exclusions, particularly around war, coming into play. “Geopolitical tensions are driving some market uncertainty, and insurers are really concerned about significant aggregation loss,” France-Hayhurst said. “Nation state actors are becoming more aggressive; their intention is to create the maximum economic loss, so key targets are critical infrastructure and digital supply chains. Insurers as a result are looking at war and infrastructure exclusions, and looking to quantify catastrophic risk.” Holding its first briefing to the media since Marsh announced a global cyber practice, which will formally launch on 1 January 2024, Butler said the move reflects clients’ needs. “Cyber is their number one issue and they are looking to us for guidance,” she said. Butler said cyber is a real challenge for c-suite executives. “Not just around risk exposure but with the spiralling costs associated with what to do and where to put those resources.” She said the lack of meaningful metrics and analytics around cyber exposure means brokers are doing a lot of work to aggregate data to get real time advice to clients. “There’s also a disconnect between the insurance world and the cybersecurity world. We speak with a lot of clients, and understanding the meaningfulness of cyber insurance and where that fits into the overall risk exposure can be a bit of a challenge,” she explained. “Cyber insurance is not a silver bullet but part of an overall risk management approach. It’s not to replace anything but to complement.” The pace of regulatory change in the cyber space is adding to the challenges facing organisations. Butler said regulation is a particular challenge for clients with business or interactions in different regions. “They need to be very mindful of the regulations in those areas and their obligations under that. And they only grow,” she said. Bateman said the regulatory environment has moved from data protection to critical national infrastructure protection. There is also a push from regulators to get clarity for consumers and investors about organisations’ cyber exposures and the impact of an incident on their balance sheet. “It does make the landscape very challenging for clients, especially larger ones that operate in multiple countries, as every couple of months there is a new update or piece of legislation,” Bateman said.

Supply chain cyber security ‘without doubt’ biggest challenge, says Marsh

Broker predicts rates will continue falling next year

Want to read this article?

Read Next

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

International SOS warns of ‘burnout epidemic’

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

International SOS warns of ‘burnout epidemic’

Want to read this article?

Read Next

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

International SOS warns of ‘burnout epidemic’

Related Articles