The hard cyber insurance hard market has become such a big issue that companies are asking themselves whether it is really worth buying the cover, leading Portuguese risk managers said during the Lisbon leg of this year\u2019s Risk Frontiers Europe survey.\r\n\r\nParticipants also expressed concerns about a lack of property catastrophe protection in the local market, especially for earthquake risks.\r\n\r\nThe transfer of systemic risks in the hard market is a challenge faced by companies across Europe, and it is particularly worrying when it comes to cyber risks, according to Pedro Cupertino de Miranda, the risk, cyber security and data protection officer at retail group Sonae.\r\n\r\n\u201cWe have to increasingly ask ourselves whether cyber insurance is of any use with its current offer. If someone tells me that cyber insurance will one day cover liability exposures, for instance linked to the leaking of data from clients, maybe so. But cyber policies today do not pay ransoms or losses linked to data breaches. If insurers offer consultancy and forensic analysis, I prefer to choose my own resources for that,\u201d he said.\r\n\r\n\u201cThe usefulness of cyber insurance is a theme that must be discussed with the insurance market,\u201d agreed Tiago Antunes, head of risk management at Metropolitano de Lisboa. \u201cWe need an answer for it, and one that is affordable.\u201d\r\n\r\n\u201cBut first of all, we need to do our homework and try to mitigate the risk as much as we can, and only transfer what is necessary to the insurance market. We cannot expect that insurers will solve all our problems with cyber,\u201d Antunes said.\r\n\r\n\u201cAnd we cannot say that we will close all our doors because that is not possible. The question is not whether an attack will take place, but when. And then when the second attack will happen and so on,\u201d he added.\r\n\r\nThose that have done so can attest to how important it is to be prepared for cyber risks. Portuguese risk managers say that cyberattacks have been taking place all the time and it is only a matter of when a company gets hit.\r\n\r\n\u201cWe often suffer tentative cyberattacks but none have been successful so far,\u201d said Jorge Neto, the insurance manager at retail group Jer\u00f3nimo Martins.\r\n\r\n\u201cRetailers are moving in the right direction, information is replicated several times and stored in units that have as high a degree of autonomy as possible. This is making us more resilient against cyberattacks,\u201d he added.\r\n\r\nCupertino de Miranda also believes that preparation is key in order not to rely on underwriters that have shown little interest in taking cyber risks.\r\n\r\n\u201cWe have invested more in cyber resilience than in cyber insurance. We believe that if we are resilient, we will be able to resume operations more quickly after an attack. Nobody wants to be three days out of business. In practice, we need to work in a way that we may not need cyber insurance,\u201d he said.\r\n\r\nBut Andr\u00e9 Rodrigues, who works for BNP Paribas in Portugal, warns that it may not be enough to do things well in-house if vulnerabilities can be found among a company\u2019s customers and suppliers.\r\n\r\n\u201cIt is necessary to build up cyber resilience as it has become very hard to transfer the risk. And that means not only building up our capabilities but also making sure that our business partners are resilient too. Interdependencies are very high, and sometimes they are almost impossible to identify with absolute precision,\u201d he said.\r\n\r\nHard market challenges\r\n\r\n\u00a0Portuguese companies have been able to find protection in other insurance segments but not always at prices, capacity levels and conditions they are comfortable with.\r\n\r\n\u201cPrice pressure has been an issue, and I am not optimistic about market capacities either. Some lines are challenging in terms of capacity, wordings and deductibles. We have had to change the way we approach the market,\u201d Neto explained.\r\n\r\n\u201cUnderwriters don't seek risks in a heterogeneous way. For example, some are focused on big risks, and others on small risks, so we need to find the right mix to place our programmes,\u201d he added.\r\n\r\n\u201cI have noticed that the hardening of the market is not limited to prices. It hits conditions too. Wordings have become more restrictive, sub-limits have been tightened and exclusions have been added,\u201d noted Neto.\r\n\r\nCupertino de Miranda added that capacity has never really been an issue for his firm. \u201cThe issue has really been price. We have a global programme that covers different parts of the world and we have had to adjust its insurance and reinsurance elements.\u201d\r\n\r\n\u201cIn the case of earthquake risks, we have a concentration of exposures in Portugal and insurers are more worried about them. In recent times, property covers have been more stable but liability lines have moved up,\u201d he added.\r\n\r\nNeto also expressed concern that Portugal does not have a risk transfer mechanism, such as a cat pool, to deal with the consequences of an earthquake. Portugal was devastated by a quake in the 18th century and it is widely feared that another strong event could hit the country at any time.\r\n\r\n\u201cIn Portugal, we are exposed to earthquake risks, we know it, that is nothing new. But what has been done to mitigate this risk? Very little,\u201d said Neto.\r\n\r\n\u201cWe don't have a financial mechanism in Portugal, a pool, constituted by the public and private sectors. It is something that we have been discussing for a while but if we suffer an earthquake today, how will we deal with its outcome?\u201d he added.\r\n\r\n\u201cCompanies that have a strong financial position will be able to react somewhat. But companies are not alone, we are all part of the economy and the country, so how will we be able to rebuild essential infrastructure such as railroads, roads, the energy system, water and sewage and so on? We will not be able to fund it all with the current financial state of the country. That is a risk that has already been identified but little or nothing has been done about it,\u201d he continued.\r\n\r\nAntunes, for his part, said that employee benefits have also presented challenges for insurance buyers.\r\n\r\n\u201cOne of our main programmes is health insurance, which is highly impacted by the average age of our workers. As people age, health problems become more frequent and treatments more complex and expensive. Medicines have become very expensive today,\u201d he pointed out.