Demand for cyber insurance: a threat or a benefit for insurers?

In response to the sharp increase in cyber threats and data breaches in recent years, insurers have made significant progress in providing cyber risk coverage for their owners. The offer of cyber risk insurance is likely to expand further in 2018, according to the rating agency Fitch Ratings.

Cyber insurance opens up opportunities for growth and business diversification for some insurers, but can be a negative factor for others, given the possibility of insured events with large amounts of losses.

The number of data security problems in the US increased by 44.7% in 2017. This frequency of such events, combined with the increase in the proportion of significant loss events such as the Wannacry and Petya ransomware attacks, highlights the challenge for insurers to price and underwrite cyber risks in a rapidly changing environment.

Cyber insurance is currently a profitable niche for many insurers as the market grows and competition in this segment increases, but, according to Fitch analysts, doing business in this area may become more difficult. In addition, market participants may be exposed to the risk of underpricing cyber insurance services and the risk of large future losses, as they may lack the unique underwriting experience for cyber insurance.

Demand for cyber insurance is likely to increase. Risk studies, such as the recent Allianz Risk Barometer 2018, continue to rank cyber risks among the top 10 risks to business. However, a December 2017 survey by insurance and brokerage agencies "Insurance Agents and Brokers" found that only 31% of respondents had purchased some form of cyber risk coverage.

Furthermore, 2018 reports from Lloyd's and AIR Worldwide suggest that individual cyber events, such as the outage of a major cloud provider in the US, could result in losses of between $6.9 billion and $14.7 billion, with only about 20% of these losses being covered by insurance payments.

Demand for cyber insurance will also be driven by increased government regulation in this area. The New York Department of Financial Services’ cybersecurity regulations, which went into effect in 2017, impose new cybersecurity certification requirements for financial services companies. This year, the European General Data Protection Regulation (GDPR) will impose stricter requirements on companies to notify of data breaches, including customer personal data. Such regulations not only raise awareness of cyber risks, but also increase the likelihood of fines for companies in the event of cyber incidents.

A growing number of companies are looking for specific products to cover specific cyber risks. For example, the increase in critical incidents that have led to data theft and extortion is leading to a growing interest in business interruption and property damage insurance. Similarly, the growing number of shareholders of companies whose reputations have been severely damaged by cybersecurity incidents is leading to an increase in demand for liability insurance coverage for owners and directors of companies.

Source: Association "Insurance Business"