Blog: Where does cyber liability end?

The law of unintended consequences dictates that actions always have effects that are unanticipated or unintended. And we are currently seeing the unintended consequences of an exponentially interconnected world play out in insurance claims departments and courtrooms across the globe.

The triple threat of frequency, severity and systemicity that cyber risk presents makes cyber underwriting one of the biggest challenges for insurers to grapple with right now.

Insurers - who with the best will in the world are rarely at the cutting edge of technology when it comes to their own operational systems - are faced with the need to keep pace with the evolving nature of cyber risk.

But the increasing sophistication of cyber criminals, frequency of major cyber attacks and the greater regulatory emphasis on data protection can make it challenging for insurers to really get a handle on their underwriting exposure when pricing cyber risks.

Don’t rush
Certainly this is a growth market - a rare thing in insurance. The cyber risk insurance sector is forecast to reach $7.5bn (£6.2bn) by the end of the decade, but this is not the time to rush cyber insurance policies to the market just to get a slice of the pie.

Let’s pause for thought and consider the evolving threat. It is forecast that the number of connected IoT devices will grow to 1bn devices by next year, ballooning to over 100bn by 2025.

Each of these devices is a potential entry-point for an attack by hackers. And according to multiple studies, around 70% of the most commonly used IoT devices have significant security vulnerabilities.

A moving target
At the same time, insider attacks are on the rise thanks to internal operational vulnerabilities, external hackers continue to successfully demonstrate their ability to cause physical damage through attacks, and regulators are demonstrating that they are serious about imposing public fines for privacy breaches.

That’s not to mention the actions of some governments and sovereign powers are complicating loss events - look no further than Mondelez vs Zurich Insurance’s dispute over a $100m NotPetya loss for evidence of this. 

Looking down the lens of IoT and its implications, cyber attacks in the future could cause widespread pollution, vehicle collisions, and even the pandemic spread of viruses thanks to the development of advanced bio printers. And so the law of unintended consequences plays out.

Brokers
Yet even today, some insureds rely on standard commercial insurance policies thinking they will cover cyber incidents, since cyber is not explicitly excluded in many policies. And where cyber insurance has been bought, there is a lack of standardisation in policy wordings - a lack that has already resulted in legal action.

Contested areas include the differences between first and third party coverage for add-on cyber wordings (as opposed to standalone policies), and the responsibilities over physical damage when cyber breaches have been responsible for this damage, particularly under commercial general liability policies.

There is a strong need not only to educate insureds, but also insurers when it comes to recognising emerging threats and emerging preventative measures.

Insurance brokers are a critical element in this process, and can directly add value to both sides by driving home the risk management message to the insureds, and the ‘no one size fits all’ message to insurers.

Strategic thinking
As well as risk management, it is critical that insurance businesses have a strategy for planning clear wordings or threats which may have unintended consequences, and communicating transparently to insureds what is covered by a policy, and what is excluded.

Protecting policyholders from cyber threats is an ongoing process, requiring regular review and active risk management.

Premium pricing must be calculated carefully, a race to the bottom on price will inevitably lead to costly losses.

To be effective, cyber audits must be much more than just a box ticking exercise. They must be truly independent and cover vulnerability and emerging threat discovery assessments, risk and compliance assessments and user awareness training at the very least.

Ideally, both insureds and insurers require training in cyber best practice, and to gain a thorough, independent oversight of their risk profile and risk management strategy, but also to standardise the language used across cyber policies, while tailoring policies for individual clients.

The question over where cyber liability ends is not one that insurance businesses should be asking themselves - let alone have the answer dictated to them by a judge after costly legal action.

By championing independent risk management and cyber auditing support, putting protecting the interests of the client at the heart of the cyber policy and not simply jumping on the cyber bandwagon, insurance brokers will play a critical role in not leaving cyber risk policies open to the law of unintended consequences.

Richard Robertson is global head of information security at Pro Global