Friday, 17 February 2012
Inability to accurately value information is holding back cyber insurance
Risk managers must do more to accurately articulate their cyber risk concerns to insurers if this evolving area of insurance is to properly develop, Mark Fishleigh, Head of Insurance at UK-based information security firm BAE Systems Detica, told an audience of over 150 risk experts at an emerging risks seminar organised by Commercial Risk Europe.
Mark Fishleigh, Head of Insurance at UK-based information security firm BAE Systems Detica
There is growing awareness of cyber risk among risk managers, as proved by the fact that it was highlighted as one of the major challenges facing the profession in CRE’s 2011 Risk Frontiers Survey. There are also an increasing number of insurance products available for cyber risks. However, said Mr Fishleigh, there is currently an imbalance between the supply from insurers and the demands of insureds in what is still an immature market.
Cyber insurance products have tended to come from two different directions—liability underwriters extending their standard coverage to include cyber-related risks and property underwriters that have finally accepted that losses can occur where there is no physical damage. There are even some policies, such as a US-based coverage for the cost of notifying customers in the event of a data breach, where some insurers are stepping back from the market because they believe it is over-supplied.
Please sign up here to our full-time mailing list to ensure that you receive our weekly newsletter.
There are, though, other areas where big gaps in coverage remain, said Mr Fishleigh, such as cyber terrorism and cyber warfare where clear definitions do not yet exist. There is also a lack of standard wordings among all cyber-related policies and different products for the same risks can vary markedly, he added.
What is clear, continued Mr Fishleigh at the Risk Frontiers seminar held on Wednesday in London, is that the cyber insurance products that currently exist are supply- rather than demand-driven. "Insurers like cyber risk. It is a new product and a new revenue stream." Furthermore its evolving status means that insurers can still charge a relatively high rate for coverage.
Demand from risk managers is not at the same level as supply, noted Mr Fishleigh, largely due to business underestimating the value of the information it holds. "Most corporates have not quantified the value of their information so it is very difficult to insure it."
It is also difficult for buyers to tell which policies represent value for money and which are too expensive without an accurate assessment of the value of their information. "I don't think risk managers fully understand the risk," warned the cyber expert.
Corporates therefore have to make more accurate and effective assessments of the information they hold and how it should be treated—something that governments, unusually, are very good at, stated Mr Fishleigh. “If you cannot protect all of your data then you should consider segregating the most critical from the less critical and applying more stringent security to the former.”
Risk managers should also focus on improving board level understanding of cyber risk, establish standards for defining cyber attacks and cyber security and participate in information sharing initiatives where possible, such as the UK’s ‘hub and node’ pilot scheme.
The full extent of the threat that organisations face from malicious cyber criminals was made clear to the audience by an earlier presentation from IT security expert Paul. C. Dwyer, an advisor to the International Cyber Threat Task Force.
Mr Dwyer referred to the so-called ‘Dark Market’, an underground stock exchange where criminals can trade stolen personal data, malicious codes and viruses, hacking tools and expertise.
He highlighted cloud mobile technology and social media as the two biggest challenges currently facing risk managers.
Mr Dwyer also supported Mr Fishleigh’s view that risk managers must improve their own level of education and that of their board when it comes to cyber risk. “Education is the key. A CEO may get sufficient comfort as regards their IT security by talking to their head of IT but it is not an IT issue per se. The risk manager has to get his board to understand the complexity of cyber risk and the fact that it has a different profile to more conventional risks.”
Please sign up here to our full-time mailing list to ensure that you receive our weekly newsletter.
Report for EC finds problems with nat cat insurance markets
Risk glass ceiling and not fit for purpose boards biggest reputational threat
Thai flood costs to mount as buyers face higher premiums and loss of cover
Deutsche Bank D&O insurers likely to hold firm in Kirch case
Insurers overwhelmingly concerned about data requirements of Solvency II
Latin American insurance market up 18.1% but penetration remains stunted
Corporate round-up
S&P raises P&I capital concerns
Roland Rechtsschutz-Versicherung appoints Bettina Hesse to board
JLT expands reach in Spain as it combines with Unipsa
IRM publishes Turkish version of ISO 31000 guide
Litmus launches training to better understand insurer numbers
In spite of progress, experts say tough tasks lie ahead for risk managers
New approach needed to cope with the global economy—Van Santen
Risk managers urged to increase involvement in M&A’s
S&P expects Eurozone to stay together as growth returns
Insurance leaders remind buyers that innovation costs money
Plus ça change, plus c’est la même chose
Lower prices and higher risks boost D&O in global program-free Brazil
Buyers angry as cat rates rise and limits fall—global programmes under threat
