How is cyber insurance evolving? 2021 has been nothing short of a surprise for cyber with major attacks and new developments on how the government, security vendors, and cyber insurance providers build their response. As we enter the fourth quarter, one of the busiest quarters for insurance because of Jan 1st renewals, it’s worth looking back at a few key metrics that define the state of the cyber insurance market.
1. Some market data on cyber insurance from AM Best
There is a reason why cyber insurance is of such interest. First and foremost, the explosion of cyberattacks has heightened demand for cyber coverage as businesses acknowledge that they need financial protection in addition to deploying cybersecurity technologies to build cyber resilience.
From an insurance perspective, cyber is the only line of insurance with organic growth: in 2020, the growth in premiums for the entire commercial lines was about 4% while the growth in cyber premiums was 21%. But this comes at a cost: loss ratios also increased from about 44% in 2019 to about 68% in 2020. One of the main challenges in 2021 is tackling ransomware attacks – ransom demands have risen from thousands of dollars in 2021 to be as high as $70 million in 2021.
2. Data from the frontline: survey of P/C insurance brokers
The Council of Insurance Agents & Brokers (CIAB) released in July the results of its quarterly survey of property and casualty insurance brokers. Cyber insurance stands out in most survey results compared to the other insurance lines. Here are key highlights:
- 95% of P/C respondents experienced an increase in demand for cyber
- The rise in claims is also one of the main reasons for the rapid increase in cyber premiums.
- Respondents report that the increase in premium is due to the rise of ransomware, as well as a lack of security measures taken by businesses
- Many brokers stated that they were leaning into making things more efficient for their clients, as well as embracing remote work to recruit new talents more effectively
The above data speaks to the need for cyber insurance to modernize through digitization, make better use of data to assess and select risk while at the same time supporting policyholders with easy-to-digest resources for them to identify, understand and reduce their risk exposures.
3. For policyholders to know: data breach events take up to 5 years to come to closure
Gallagher Re’s report is focused on ransomware claims and insurance reserve funds. But it also sheds light on the lifecycle of cyber incidents, data breaches, and ransomware attacks. Most of us are in denial or don’t know that resolving a cyber incident that includes a breach of data can take up to 5 years to get resolved.
There is a long tail of activities post incident. It can take up to 5 years for an incident to get to closure when sensitive data has been breached.
The report argues that “discovery and notification of ransomware losses surface much quicker than traditional data breach events” since victims become aware of a ransomware attack quickly and need to act (by paying or deciding not to pay) shortly after. Data breaches often take longer to get noticed as well as remediated. Since victims typically conduct a cost-benefit analysis that helps them make that decision, ransomware events are usually settled within 1.5 years, while data breach events often take up to 5 years to be closed.
However, ransomware attacks are now developing into data breach events, during which the criminals not only encrypt data but also threaten to release it. Basically, ransomware events are rapidly running into data breach events requiring too up to 5 years to get closure on.
We encourage you to read the report as it provides great graphical representations of the lifecycle of cyber incidents – data breach, ransomware, and ransomware with data extortion.
4. The government taking actions to thwart cyber attacks
The White House met with industry giants on how to better protect companies from cyber incidents
On August 25th, the White House published new initiatives to fight the cyber attack epidemic on a federal level. President Joe Biden met with top executives of finance, insurance, infrastructure, and tech giants (including Google, Microsoft, and IBM) to discuss how to defend American companies from the growing and developing cyber threat landscape.
Within the tech company, new initiatives include
- Apple continuously releasing security improvements throughout the technology supply chain,
- Google investing $10b into cybersecurity over the next five years in the form of a zero-trust program, as well as software supply chain, and open-source security,
- IBM training 150,000 employees in cybersecurity skills over the next five years.
The outcomes of the summit show just how critical investing time, effort, and resources into cybersecurity is.
We are now entering October, cybersecurity awareness month. As an active supporter and participant in the program, Cowbell will share additional resources, tips, how-tos, guidelines, videos, and more to demystify what good security hygiene is about and help policyholders and brokers build cyber resilience.
The last 18 months prove that no business, no matter its size, is safe from incidents, and dedicated cyber coverage is one of the most important steps in ensuring a quick response and recovery from cyber incidents. If you’re an agent in search of an efficient way to provide robust cyber coverage to your clients, contact us at ntrapvrf@pbjoryyplore.nv to get appointed.
