Geneva Association: Advancing accumulation risk management in cyber insurance

23 August 2018

A study by the Geneva Association concludes that growth in the cyber insurance market should not be taken for granted because accumulation risks must be addressed.

A study by the Geneva Association reveals that cyber insurance offerings and premium volumes have expanded considerably and loss ratios have compared favourably relative to other product lines. But “keeping up with demand is challenging and sustainable growth in the cyber insurance market should not be taken for granted as accumulation risks need to be addressed in the context of a hyperconnected digital world”, it adds.

The study, titled Advancing Accumulation Risk Management in Cyber Insurance, states that cyber risk awareness in large and small businesses is increasing, and demand for insurance will likely be strong for some time. But it explains that there are three prerequisites to ensure the sustainability of cyber insurance: customers and insurers must facilitate resilience at the source of risk; insurers need to make an acceptable return on capital; and available capital must absorb shocks from accumulation risks.

“Expanding the boundaries of insurability is not new for insurers. However, cyber risks are taking us into uncharted territory. Both exposures and threats have distinct characteristics, bringing unprecedented challenges,” commented Anna Maria D’Hulster, secretary general of the Geneva Association.

The report points out that cyber risk creates several unprecedented challenges:

• Exposure bases are hard to define and measure, and they are constantly changing
• Historical claims data is scarce and not considered to be well representative of future vulnerabilities
• Threats are constantly evolving; they can spread widely and rapidly, and a series of consecutive large events is plausible
• A high degree of interconnectivity may result in potentially unbounded impacts.

It says these challenges require insurers to strengthen their core underwriting capabilities, in particular exposure measurement, claims assessment, and accumulation modelling. The report finds that insurers have taken several steps to make it manageable, including playing an active role in helping companies build resilience, a trend that is expected to continue.

The report highlights four cyber accumulation risk challenges:

• A single large event or a series of consecutive events may make affirmative cyber insurance unprofitable
• Insurers and reinsurers could underestimate cyber exposures resulting in unplanned shocks from a major event
• Data of insufficient quality for more advanced modelling techniques
• Governments predominantly fail to provide frameworks for the sharing of cyberterrorism-induced losses.

As a result of these challenges, insurers and reinsurers could withdraw from the market after unacceptably high losses and fear of repeat events. In addition, growth of the small alternative capital market may be stalled and prevent insurers from accessing needed capacity, while re/insurers could introduce tighter policy terms and in doing so increase the number of exclusions and/or make buybacks prohibitively expensive, notes the report.

Full study

Article on Commercial Risk (subscription required)

© Geneva Association