Identifying real cyber systemic risk still ‘biggest insurance challenge’

Accurately identifying or predicting a real systemic cyber scenario remains the biggest challenge for the re/insurance industry today because insurers are still forced to make a lot of assumptions, according to Meike Röllecke, head of cyber and financial lines at HDI Global SE.

“We as an insurance company might not get enough information from our clients to identify what their systemic risk might be,” she explained to Intelligent Insurer.

The industry has already experienced some big cyber insurance scenarios involving zero vulnerabilities—an undiscovered security flaw in an application or operating system— and large ransomware attacks, but Röllecke said that a huge impact had not been seen yet.

When thinking about major systemic cyber scenarios, she said: “The question is: ‘Is it a real scenario or is it because we watch too many movies or read too many books?’.”

Her comments came ahead of her taking part in a panel discussion titled “Rethink cyber systemic risk—Approaches to break down obstacles hindering growth and sustainability in the cyber insurance marketplace” at Intelligent Insurer’s Cyber Risk Insurance Innovation Europe 2024 event (February 8, London). 

Röllecke said that in the past few years she has seen cyber scenarios that looked like they could become a real case, but upon closer inspection it became clearer they were unlikely to happen. With the numerous checks and balances in place, certain events would never get the chance to become a very big systemic scenario. This is the reason that getting the right level of information and identifying real scenarios is the biggest issue, she added. 

“If we have the right level of information, we are able to properly predict and model the impact of these scenarios. But when we aren’t able to collect the right information and identify the true scenarios that’s an issue.”

Röllecke explained that the challenge to proportionately predict scenarios is one the whole insurance industry is facing, but she added that the definition of scenarios has improved as the quality and volume of information have increased. 

“At HDI we have built up a lot of expertise within the last few years. We’ve spoken to our clients’ chief executive officers, chief information officers and their IT people to identify scenarios and to get information on a regular basis rather than only once a year.”

However, she added, the shift from yearly information gathering to ongoing information updates has taken some work, because clients prefer yearly information catch-ups. To overcome any reluctance from clients to provide continuous or at least more regular information, she said that HDI has made an effort to be a partner in this transformation of communication and to support clients in a continuous way. But she conceded: “It’s still a challenge to balance these two issues.”

Ongoing communication with clients is clearly crucial, and Röllecke said that events like Cyber Risk Insurance Innovation Europe 2024 are very important to give clients, brokers and insurance companies the opportunity to exchange thoughts on these topics. 

“We need to find a way to deal with cyber systemic risks together as an industry because it’s one of the biggest threats worldwide,” she concluded.

For more on the impact of cyber risk, you can see Meike Röllecke, head of cyber and financial lines at HDI Global SE, speak live at the Intelligent Insurer Cyber Risk & Insurance Innovation Europe 2024 event on February 8, 2024, in London.