Understand risk: why it’s time to ‘SPICE up your cyber’

Understanding cyber exposure in real world tangible business terms can be complex. But putting a number on cyber risk is critical for businesses to protect themselves and the wider markets they operate in, according to Philippe Cotelle, vice president of the Federation of European Risk Management Associations (FERMA) and head of Cyber Insurance Management and Insurance Risk Management at Airbus Defence and Space.

Speaking to Intelligent Insurer ahead of his keynote speech at Cyber Risk and Insurance Innovation Europe 2023 (February 7, London), Cotelle said that cyber exposure and insurance cover remains unknown territory for many businesses. But he is determined to address this and has already made in-roads with his work in the French cyber insurance market and other countries in Europe, including  Belgium and Italy.

In 2016, he began by working to understand what various cyber attacks would mean for his own business  Airbus Defence and Space. To do this he developed ‘SPICE’, or ‘Scenario Planning for Identification of Cyber Exposure’. Under this initiative he and colleagues developed risk and exposure scenarios for different levels of cyber attacks and then analysed in detail what that would mean for the business. The scenarios could be anything from an attack that stops a business ordering from its supplier to disrupting customer billing or even a total shutdown. The team then looked at the business-wide knock-on effects of these scenarios in financial terms.

Leaders of the business were happy because they could see the most sensitive aspects of the business, he said, because SPICE helped quantify the return on investment on the budget [for cyber insurance].

Through this work, he recognised a much bigger issue: the mismatch between cyber insurance demand and supply in France and internationally.

“In 2016, [the cyber insurance market] was really soft. You could buy something very cheap, but the question was, ‘what were you buying?’”

A lack of transparent communication and data sharing among market players and their insureds was at the heart of this problem. It was preventing the cyber market from developing.

“The insureds were uncomfortable with the kind of requests and questions that were asked by the insurer. They didn't understand the relevance of the information that was being requested? And, they wanted to know, ‘how the answer to these questions would influence the way the insurer would evaluate them?’ The human reaction, when you don't really know how to assign information, is to provide as little information as possible,” he said.

He saw that such a lack of transparency and quality data in the market was likely to lead to a crisis, so he developed another strategy to work through the issue called LUCY, or ‘Lights Upon Cyber Insurance’. LUCY pinpointed a stakeholder, the French Risk Management Association, that could and should ask insurers to provide cyber exposure data from across their portfolios anonymously. This quality data became a report showing premiums and claims in the French market for cyber by size of companies. It also showed the root causes for the issues in the market. One surprising finding, he said, was that in 2020 just four claims together were sufficient to wipe out the entire market premium insurance. Armed with this information, Cotelle began working through the problems across the French cyber market, through this work he gained recognition from across Europe and began working with FERMA to use his solutions in more countries in Europe. Now he is working on plans to support cyber insurance market development globally.