Cyber attacks becoming more of a threat to insurers: AM Best

Insurers are increasingly vulnerable to cyber attacks, according to rating agency AM Best.

In a new report, the firm said that although it considers natural catastrophe losses to be the primary threat to the financial strength and credit quality of property/casualty insurers, the increasing frequency and severity of cyber attacks, and difficulty in measuring the risk, pose a substantial threat to the insurance industry.

The report, AM Best’s View on Cyber-Security Issues and Insurance Companies, recommends that effective risk management using a holistic approach to address the problem, suggesting that the company’s technology, people and processes work together to minimise cyber-security risks.

“Recent breaches at large managed health care organisations have highlighted the fact that an insurance company’s breach can have wide-reaching effects, impacting staggering numbers of individuals and organisations,” said the firm.

The firm also said that research has warned that a total realistic probable maximum loss for cyber-security risk globally is currently approximately $31 billion. It said it is currently analysing cyber-security exposure in an effort to increase awareness of this threat and assess the impact on an organisation’s financial strength.

“Assessments have historically been limited to the technology-based controls an organization has in place, but technology alone is not an adequate predictor of overall cyber-security posture or risk,” said AM Best.

“An assessment of the susceptibility of a company’s cyber-security posture from the perspective of technology, people, processes and preparedness must also be undertaken. The next step in understanding a company’s overall cyber-security risk is an evaluation of the motivation of threat actors like criminal hackers, state-sponsored groups and rogue employees to direct their efforts at a particular company.

“It is AM Best’s opinion that an evaluation of the offensive and defensive forces apparent in the susceptibility and motivation of an organisation is essential to understanding an entity’s overall cyber-security risk. AM Best views an organization’s ability to generate detailed and credible assessments of its potential cyber risk as a valuable tool in its overall risk management approach.”

The report also summarises results obtained from various surveys and questionnaires Am Best has conducted over the years as part of its interactive rating process, and explores areas where companies can improve their risk profiles.

Two main trends have become evident in the surveys, according to the firm. First, most companies tend to be inclined to invest large sums of money to improve security on their IT systems and infrastructure. Secondly, larger companies tend to buy cyber insurance policies to further manage the risk associated with a cyber attack, protecting themselves and ultimately their policyholders, said AM Best.

The firm also said the insurance industry may be contemplating new company formations to exclusively write cyber-security insurance.

“As cyber-security risk is better understood, and underwriting and risk management functions are enhanced and specific consequence-oriented data and actuarial studies become available, AM Best will continue to incorporate its findings into the rating process,” it said.