AM Best questions insurers’ data modelling ability on cyber

While cyber insurance and reinsurance is expected to enjoy strong growth in the years ahead, there remain considerable challenges to the companies operating in this market, including the ability to price the risks accurately and get a handle on accumulation risks.

That is according to Stefan Holzberger, senior managing director and chief rating officer, AM Best. He noted there seems to be a consensus that this market will grow through 2020–2022 partly on the back of cyber incidents which are increasing rapidly, particularly in 2015 and 2016, and continuing into 2017.

AM Best reported in June that premiums for US insurers writing cyber lines increased by 34 percent in 2016 over 2015.

There are many challenges, Holzberger said. “The main barriers to potential growth of cyber insurance and reinsurance markets are accurate pricing, establishing commonality among the types of policies needed and the difficulties insurers may have in aggregating this risk, thus hindering the development of appropriate reserving practices,” he said.

He also noted that there seems to be a shift from packaged policies to standalone policies. This transition to standalone cyber policies may contribute to better pricing and reserving methods, which may ultimately lead to refinements in modelling tools and to more accurate understanding of risk aggregation.

“It may also contribute to reducing or eliminating certain unnecessary expenses related to expensive litigation,” he said.

“But,” he added, “AM Best is not convinced that insurers currently have the ability or the data modelling tools necessary to determine their own individual exposures under a specific scenario.

“While we believe that a great amount of technical expertise and talent has been invested in cyber modelling, it is crucial that accurate data and information become available to modellers so that each insurer’s cyber probable maximum loss under various scenarios can be determined.”

Holzberger stressed that there remains uncertainty among companies as they contemplate cyber exposure.

“Most realise that the protection they need may not be available in the market or be prohibitively expensive. Typically, a two-pronged approach is taken: companies (i) invest as much as they can internally to mitigate the risk by improving internal infrastructure and protections against cyberattacks; and (ii) buy a decent amount of coverage from insurers in case these internal protections fail.”

He added that AM Best expects companies to provide detailed and credible assessments of their potential loss accumulations (be it nat/cat, terrorism or cyber). He noted that modelling for nat/cat is much easier because of documented cases that generate good historical data.

“However, similar data on cyber events are very limited. The elements impacting cyber attacks include a variety of human factors and technological commonality, from human sentiments (employees, ex-employees, motivation of attackers), to network complexity (domain name and cloud providers, etc), to internet and social media activities and presence,” he said.

Holzberger added that regulators can have a positive impact by requiring companies to make public disclosures, not only regarding how they protect themselves against cyber attacks, but also by disclosing any cyber breaches, which makes it easier to accurately assess the impact and frequency of such attacks.

Finally, he said, although total economic losses are large, estimates of potential insured losses from each event are far lower due to limited insurance uptake rates. These scenarios focus on explicit cyber exposures and estimated insured portions of losses range from 7 percent to 17 percent.

“These insured portions are relatively low but, in the real world, as cyber insurance premiums and limits rise, cyber exposures will become more important to AM Best’s rating process,” he said.

Get the latest re/insurance news sent to your inbox every day -  Sign up to our free email newsletters

More players are drawn to mortgage reinsurance by its growth, innovation, returns

Casualty remains tough but pockets of opportunity will emerge

Rates will now increase as reinsurers refill their depleted cat reserves

Keep your discipline when innovating

PCI looks to boost awareness of rises in auto fatality rates

HIM losses an earnings event for reinsurers

Divergence in risk helps prove role of data

Sleepwalking into unexpected cyber loss

Hurricane Nate will not generate material losses, says RMS

The fear factor will determine rate hikes

Cat losses prove uncertain nature of industry

Regulators need education on big data

Flood modelling is challenging but vital

US P/C market rocked but resilient after storms, claims S&P

A new type of partnership

Don't miss our insurtech email newsletter - sign up today