Insurance industry can do more to boost cyber risk management
Source: Middle East Insurance Review | Jan 2018
The insurance industry is already contributing to cyber risk management, but it has the potential to do much more, said a report from the Organisation for Economic Co-operation and Development (OECD).
While not a substitute for investing in cyber security and risk management – having good cyber security and avoiding a disruption is preferred – insurance coverage for cyber risk can make an important contribution to the management of cyber risk. The market currently does this by sharing expertise, differentiating its pricing based on levels of risk and providing valuable support to both large and small companies in responding to crises.
However, the potential contribution of insurance markets to the management of cyber risk is even greater, said the OECD. It noted that the standalone cyber insurance market remains a fraction of the size of other commercial property and liability insurance markets with penetration levels near 30% of companies in almost all countries. For SMEs, the penetration rates are in the range of single digits.
Coverage limits are usually much lower than what is available for other perils and provided at a much higher premium level. In addition, some of the most important needs of companies, such as coverage for losses related to reputational damage or intellectual property theft, are rarely covered by cyber insurance products, the report said.
Overcoming the major obstacles to the development of the cyber insurance market could lead to greater and wider coverage of cyber risk and have a larger impact on risk management.
The lack of historical data on cyber incidents and the ever-evolving nature of the risk impede the ability to develop probabilistic pricing and exposure management models.
In addition, the lack of trusted models reduces the willingness of insurers (and reinsurers) to extend significant amounts of coverage and leads them to apply various exclusions and sub-limits to control their exposure, which then leads clients to question the value of cyber insurance in its current form. M