Silent Cyber Risk is Largest Inhibitor of Cyber Insurance Market Growth, UK Study Finds

By a News Reporter-Staff News Editor at Insurance Weekly News -- A new study of the UK cyber risk insurance and broker community reveals startling findings. First and foremost, the insurance industry needs to address non-affirmative cyber in a meaningful way. Second, measurement of cyber risk in financial terms is highly deficient among insurance customers and the insurance industry itself. Finally, a series of catastrophic cyber events or a systemic cyber event will drastically alter the way in which insurers measure the risk profile of each applicant.

The survey was sponsored by Secure Systems Innovation Corporation (SSIC), the cyber risk management firm that created X-Analytics®, the world's first cyber risk model that quantifies the economics of cyber risk.

More detailed survey results follow: 'Silent' Cyber Risk is Key Market Growth Inhibitor More than three-quarters (77 per cent) of UK cyber risk insurance brokers and insurers believed that the insurance industry needs to urgently address non-affirmative cyber or 'silent cyber' in a deeper, more meaningful way. Silent cyber refers to instances where cyber perils (such as service interruption or data breach) are neither explicitly included, nor explicitly excluded, by an insurance policy's wording. There was also a recognition that this problem could not be resolved swiftly, according to 22 per cent of respondents. Lack of Cyber Risk Understanding Inhibits Purchasing Responses to a separate question on why cyber insurance is not being purchased by more companies as a means of transferring risk indicated that companies 'not understanding policy coverage' and 'cyber policies were still too confusing and did not tie easily to known cyber peril categories,' were the second and third most heavily-weighted responses respectively. The most significant factor holding back the market from the buyer's perspective was firms 'not understanding their own risk exposures,' according to respondents. Inadequate Customer Measurement of Cyber Risk Results also reveal that an astonishing 89 per cent of respondents know that their customers either have an inadequate method for measuring the cost of a data breach or remain unsure of their customers' data breach measurement capability. The same percentage (89 per cent) said that customers could not adequately measure the potential impact of a cyber extortion (e.g. ransomware) event.

Customer measurement capability across other cyber perils fared little better. Eighty-seven per cent of insurers and brokers said customers had inadequate or unknown measurement systems for theft of intellectual property. Additionally, 83 per cent of respondents felt that customers could not measure the cost of a cyberattack that interrupts service.

Only one in every seven customers (14 per cent) has adequate measurement for cyber/physical (property and casualty damage due to cyber incidents) peril events. Only 10 per cent of insurers indicated that customers were adequately measuring likely costs associated with a potential data breach. Cyber Perils Disconnected from Policy Clauses Linked to silent cyber exposure, nearly half (47 per cent) of respondents admitted to having no clear connection between core cyber peril events and cyber risk insurance cover elements in their policy wording. Only eight per cent of insurers and brokers felt their policy wording now closely reflected the top five most-understood cyber peril threats.

If insurers do not map key cyber peril events to key cyber risk policy clauses-defining affirmatively what is explicitly covered or excluded-there is a real danger that vital cyber perils will not be covered. Catastrophic or Systemic Events Set to Reshape Cyber Insurance Market Sixty-two per cent of respondents agreed that a series of catastrophic cyber events or systemic event (single action that impacts claims on multiple policies within insurers' portfolios) could drastically alter the way in which insurers measure the risk profile of cyber insurance applicants. A further 35 per cent said that catastrophic claims had the potential to reset the market but that this would depend on the size of resulting claims. Aggregated Risk Uncertainty Hinders Cyber insurance Book Growth The survey also uncovered strong evidence of a lack of market understanding and pricing of aggregated risk. Six out of every 10 cyber brokers and insurers (60 per cent) agreed or strongly agreed with the statement that 'lack of understanding of aggregated risk within cyber insurance portfolios is hindering market growth.' Board-Level Demand is Largest Purchasing Driver Specific demand for cyber cover from board-level executives is the most heavily weighted driver of new cyber insurance sales. Demands placed on boards by due diligence requirements runs a close second.

These due diligence demands perhaps explain why 'the board as a whole' is regarded as the most significant decision-making group for new cyber cover (for 42 per cent of all respondents). Risk Remediation Versus Risk Transfer Poorly Understood With cyber risk, there are only three practical choices: remediate, transfer, or accept cyber risk. This assumes that each organisation has the ability to measure cyber risk and draw a delineation between risk remediation and risk transfer.

Nearly three-quarters (73 per cent) of respondents believe that most organisations do not understand the delineation between risk remediation and risk transfer as a mechanism to buy cyber insurance. This implies that most organisations are using intuition to determine the type and limit of their cyber coverage. Outside-in Cyber Risk Assessments Not Good Enough Only a tiny minority of brokers and insurers (2.6 per cent in this survey) believe that information gleaned from a short questionnaire or internet-based tool is an effective way to measure an applicant's risk profile. However, the use of 'outside-in' internet-based tools and short questionnaires continues to dominate. Remarkably, only five per cent routinely commission a risk assessment from a third-party cybersecurity vendor to better understand their applicant's risk profile. This must change if carriers are to manage cyber book risks adequately. Brokers to Carry Largest Share of Market Education More than nine out of every 10 insurers and brokers (94 per cent) saw a significant need to educate the buyer during the pre-sales process to expand sales opportunity and avoid misalignment of cyber insurance policy to customer needs, with 65 per cent of respondents putting the onus on brokers to educate the market. Only a tenth (11 per cent) felt an independent third-party body or regulator (sponsored by the industry) ought to take the lead. A further 11 per cent felt underwriters ought to be responsible for this market education work.

Keywords for this news article include: Information Technology, Information and Data Security, Secure Systems Innovation Corporation (SSIC).

Our reports deliver fact-based news of research and discoveries from around the world. Copyright 2018, NewsRx LLC