Why it is important to tap into the potential of cyber insurance

Cyber insurance is a potentially huge—but largely untapped—opportunity for insurers and reinsurers globally. The global cyber insurance market could grow to $5 billion in annual premiums by 2018 and at least $7.5 billion by the end of the decade, said a PwC report, Insurance 2020 & beyond: Reaping the dividends of cyber resilience.

Cyber insurance is used to protect businesses and individuals from Internet-related risks, and those relating to information technology infrastructure and activities.

Businesses across all sectors are beginning to recognise the importance of cyber insurance in today’s increasingly complex and high-risk digital landscape. In turn, many insurers and reinsurers are looking to take advantage of what they see as a rare opportunity to secure high margins in an otherwise soft market.

Cyber insurance could soon become a client expectation and insurers that are unwilling to embrace it risk losing out on other business opportunities if cyber products don’t form part of their offering.

Critical exposures

Globally, there is scepticism over cyber insurance. Part of the challenge is that cyber risk isn’t like any other risk insurers and reinsurers have had to underwrite. There is limited publicly available data on the scale and financial impact of attacks. The difficulties created by the minimal data are heightened by the speed with which the threats are evolving and proliferating. While underwriters can estimate the likely cost of systems remediation with reasonable certainty, there is not enough historical data to gauge further losses resulting from brand impairment or compensation to customers, suppliers and other stakeholders. There are growing concerns about both the concentrations of cyber risk and the ability of less experienced insurers to withstand what could become a fast sequence of high loss events.

Market growth

As recognition of increase in cyber threats, the take-up of cyber insurance in under-penetrated industries and countries continues to grow, and companies face demands to disclose whether they have cyber coverage. There is a strong appetite among underwriters for further expansion in cyber insurance writings, reflecting what would appear to be favourable prices in comparison to other areas of a generally soft market.

Part of the reason for the high prices is the still limited number of insurers offering such coverage, though a much bigger reason is the uncertainty around how much to put aside for potential losses. Many insurers are also setting limits below the levels sought by their clients. Insurers may also impose restrictive exclusions and conditions. Given the high cost of coverage, the limits imposed, the tight attached terms and conditions and the restrictions on whether policyholders can claim, many policyholders are questioning whether their cyber insurance policies are delivering real value. Such misgivings could hold back growth in the short term.

Setting the right price

There are various ways insurers, reinsurers and brokers could put cyber insurance on a more sustainable footing and take advantage of the opportunities.

Judging what you could lose and how much you can afford to lose: Pricing will continue to be as much of an art as a science in the absence of robust actuarial data. It may be possible to develop a much clearer picture of the total maximum loss, and match this against risk appetite and risk tolerances.

Sharpen intelligence: To develop more effective threat and client vulnerability assessments, it will be important to bring in people from technology companies and intelligence agencies.

Share more data: More effective data sharing is the key to greater pricing accuracy.

Real-time policy update: Annual renewals and 18-month product development cycles will need to give way to real-time analysis and rolling policy updates.

Hybrid risk transfer: While the cyber reinsurance market is less developed than its direct counterpart, a better understanding of evolving threat and maximum loss scenarios could encourage more reinsurance companies to enter the market.

Risk facilitation: Given the more complex and uncertain loss drivers surrounding cyber risk, there is a growing need for coordinated risk management solutions that bring together a range of stakeholders.

Build credibility through effective in-house safeguards: Insurers also need to continue to invest in their own cyber security given the volume of sensitive policyholder information they hold which, if compromised, would lead to a loss of trust that would be difficult to restore.

Edited excerpts from PwC report, Insurance 2020 & beyond: Reaping the dividends of cyber resilience.