Cyber Market Update

In 2020, many of our Insureds felt the impact of a hardening cyber market.  As Q1 2021 comes to an end, we are finding that the cyber market is no longer hardening; it’s hard.  The digital transformation and current business environment, particularly the change to remote work, have led to challenges in the industry, and the cyber market is taking action.

Anxiety over cyber risk is at an all-time high, and COVID-19 and the economic ramifications of the pandemic have heightened underwriting scrutiny.  According to a NetDiligence survey, global leaders ranked cyber risk higher than COVID-19 when asked what keeps them up at night.

Many cyber carriers we’ve spoken with indicated Insureds should be prepared for an average premium increase of anywhere between 10 and 50 percent, not including any price increase due to an increase in exposure.  Some carriers plan on reducing limits across the board, and some plan to pull back on certain coverages such as ransomware and dependent business interruption.  A number of carriers are starting to include co-insurance for ransomware coverage, and if adequate security controls aren’t in place, then they aren’t offering coverage at all.  Carriers are also being more stringent in risk selection and are conducting more diligence during the review of submissions.  It’s more important than ever to provide carriers as much information as possible in order to obtain the most favorable terms and conditions.

“The current Cyber market is nothing like we’ve seen before. The average cost of a Cyber claim has been steadily increasing and the premiums for these policies are finally catching up,” according to Amanda Stantzos, Vice President of Cyber Underwriting at Corvus.  Unsurprisingly, Amanda stated that “carriers are starting to ask more stringent underwriting questions while adjusting rates for the hardest hit classes.  InsurTech companies, like Corvus, are using their scanning and alerting capabilities to make more informed underwriting decisions and help Insureds with risk mitigation.”

This new cyber market reality presents challenges for Insureds and brokers alike.

Cyber Claims

The systemic risk associated with cyber incidents and claims is a large driver of this new reality.  Look no further than the recent SolarWinds cyber incident.  Although the full impact of the incident is still unclear, experts are estimating that insurance losses associated with it could cost more than $90 million.  And the number of companies affected by the hack continues to rise.  The recent Microsoft hack will only increase the urgency carriers feel to adjust pricing and limit exposure.

Ransomware attacks have also skyrocketed, and unfortunately, the tactics used by cybercriminals continue to evolve.  Double extortion has become commonplace, increasing claims costs.  As these claims hit the cyber carriers’ books, they are adjusting their portfolios and pricing accordingly

According to the security software company, Sophos, approximately 51% of companies acknowledged a ransomware attack in 2020, with the average ransom demand increasing to $1.4M.  Experts are seeing ransomware demands as high as $20M.  The average cost of recovery was $700,00 when companies did not pay the ransom, according to their May 2020 survey.

Fines levied against companies following a cyberattack are also on the rise.  In August 2020, US regulators imposed an $80 million fine on Capital One for its 2019 data breach that impacted approximately 100 million people in the United States and 6 million people in Canada.  The Office of the Comptroller of the Currency found numerous security deficiencies that constituted “unsafe or unsound practices.”

Cyber Security Solutions

In addition to providing coverage, and paying claims, carriers are providing solutions.

In the past, insurance companies have helped drive regulatory safety changes through mandatory measures, such as requiring seat belts or airbags in vehicles in order to get coverage.  With the influx of large losses, many experts in the insurance and the cyber security world believe these same efforts will present themselves in the cyber insurance space.  As carriers start requiring companies to implement basic security measures and mitigation tools, it’s certainly possible that certain industries or legislative bodies will force a common standard.

It’s challenging to target the severity of claims, but carriers want to help with the frequency of claims.  This can be done through a holistic risk management approach; managing cyber resilience is just a cost of doing business in today’s interconnected world.

Perfect security isn’t feasible or realistic.  The risk management solutions need to be appropriate for the company and should make economic sense; there is no one-size fits all answer.  But, there are some straightforward ways to improve your security posture, and in tandem, better position yourself in the cyber market.

1. Implement multi-factor authentication. While a hacker may be able to access your username and password, it’s much more difficult to get access to another set of credentials.
2. Establish dual control when transferring company funds. Requiring a second individual to confirm the transfer greatly reduces the chances of loss.
3. Conduct regular software updates and patches. Security flaws are bound to come to light, so make sure to correct these flaws as soon as possible.
4. Avoid public wi-fi and utilize a VPN. Weak or open networks, like the free wi-fi at your local Starbucks, create opportunities for cybercriminals to monitor your network and steal credentials or confidential information.
5. Conduct employee training related to cyber incidents, particularly how to spot phishing e-mails. Employee training is an inexpensive way to boost the first line of defense – your employees.

Engaging an experienced broker is more important than ever during a hard market.  Assessing each individual insured’s risk is paramount when attempting to obtain the most favorable submission review.