Cyber Risk

Companies Ill-Prepared to Deal With Cyber Attacks

Companies plan to boost spending on cyber security to deal with an onslaught of cyber attacks.
By: | February 22, 2017 • 4 min read

Despite a barrage of cyber attacks on businesses in the U.S. and abroad – with American firms targeted most often – more than half are ill-prepared to deal with the threat, according to a survey by specialist insurer Hiscox.

Cyber crime costs the global economy more than $450 billion in 2016, Hiscox said. Losses included business interruption and reputational damage to brand.

The findings show 72 percent of U.S. firms with 250 or more employees, and 68 percent of smaller American companies experienced a cyber incident within the past year.

Nearly half of the U.S. firms (47 percent) reported two or more incidents during the last year.

U.S. firms suffered the most serious and costly attacks even though nearly half of those businesses were ranked as “experts” by the survey in dealing with cyber threats.

Martin J. Frappolli, senior director of knowledge resources, The Institutes

Martin J. Frappolli, senior director of knowledge resources for The Institutes/Risk and Insurance Knowledge Group, said many organizations don’t fully recognize that “first party risks are just as big as third party risks and more commonly sources of lost revenue.”

“The biggest risk of cyber breach is the continuity of the business,” he said. Depending on the length of the business disruption, the loss of revenue, he said, could be financially devastating.

Another matter to keep in mind, Frappolli said, is the increased data sharing between firms, vendors and business partners. “The chain is only as strong as its weakest link.”

In the “Hiscox Cyber Readiness Report 2017,” U.S. firms reported their top cyber security challenges were the changing nature of threats, both internal and external.

To deal with them, 63 percent plan to increase spending on cyber security over the next year with the most money invested in technology, followed by training, cyber security, security staffing, other measures and outsourcing. Many plan to buy cyber insurance.

Technology is the top investment despite being the area where most firms appear to be best prepared.

“This isn’t necessarily about throwing money at technology. It’s about having a well-rounded strategy, process and resources,” said Dan Burke, vice president and cyber product head at Hiscox USA. “This is a human problem as much as it is a technology problem.”


Training employees to recognize potential threats, such as phishing scams in emails, and having strong password management can go a long way toward cyber security, he said. Seven out of 10 respondents say training has reduced the number of business disruptions.

Emily Cummins, a member of the board of directors of RIMS, the Risk Management Society, and managing director of tax and risk management at the National Rifle Association, is a strong proponent of employee cyber risk training.

Emily Cummins, director of tax and risk management, National Rifle Association

“The No. 1 recommendation is always continuous training,” she said. “And that means year-round reinforcement because employees are a source of unintentional errors and training can prevent [breaches].”

Cummins said training done in collaboration with departments, divisions or teams and including top management presents a powerful message to employees that prevention is critical to the organization. She also recommends devising a breach, or disaster response plan and practicing it regularly.

Most survey respondents listed cyber insurance as a key priority, with 57 percent saying they intend to purchase or enhance cyber insurance coverage this year.

More U.S. firms (55 percent) have cyber insurance policies than companies in the U.K. (36 percent) and Germany (30 percent). Another 25 percent of U.S. firms said they plan to take out a policy this year.

Frappolli said a firm’s risk manager, or a good insurance broker, can help determine which type of policy is best, since there is no standard product. Choices include cyber liability policies, business interruption policies, first party coverages, and endorsements or riders to existing policies.

He advised firms to purchase insurance to fill in the gaps not covered by training and technology and to have a breach plan in place in the event a hack occurs.

“Use the whole toolbox,” Frappolli said. “Don’t just think ‘I want to buy insurance’ and I’m done.”

Released in February, “The Hiscox Cyber Readiness Report 2017” details the results of a survey of 3,000 firms according to their cyber readiness in four key areas — strategy, resourcing, technology and process — and ranks them from novice to expert. It includes their plans to combat the threat going forward and offers advice on how to best prevent and manage it.

Conducted by Forrester Consulting on behalf of Hiscox, the survey, taken in late 2016, questioned executives, managers and IT specialists in charge of cyber security at 1,000 companies of all sizes each from U.S., Germany and the U.K.

Jodi Spiegel Arthur is a long-time journalist. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Report: Marine

Crewless Ships Raise Questions

Is a remote operator legally a master? New technology confounds old terms.
By: | March 5, 2018 • 6 min read

For many developers, the accelerating development of remote-controlled and autonomous ships represents what could be the dawn of a new era. For underwriters and brokers, however, such vessels could represent the end of thousands of years of maritime law and risk management.

Rod Johnson, director of marine risk management, RSA Global Risk

While crewless vessels have yet to breach commercial service, there are active testing programs. Most brokers and underwriters expect small-scale commercial operations to be feasible in a few years, but that outlook only considers technical feasibility. How such operations will be insured remains unclear.

“I have been giving this a great deal of thought, this sits on my desk every day,” said Rod Johnson, director of marine risk management, RSA Global Risk, a major UK underwriter. Johnson sits on the loss-prevention committee of the International Union of Maritime Insurers.

“The agreed uncertainty that underpins marine insurance is falling away, but we are pretending that it isn’t. The contractual framework is being made less relevant all the time.”

Defining Autonomous Vessels

Two types of crewless vessels are being contemplated. First up is a drone with no one on board but actively controlled by a human at a remote command post on land or even on another vessel.

While some debate whether the controllers of drone aircrafts are pilots or operators, the very real question yet to be addressed is if a vessel controller is legally a “master” under maritime law.


The other type of crewless vessel would be completely autonomous, with the onboard systems making decisions about navigation, weather and operations.

Advocates tout the benefits of larger cargo capacity without crew spaces, including radically different hull designs without decks people can walk on. Doubters note a crew can fix things at sea while a ship cannot.

Rolls-Royce is one of the major proponents and designers. The company tested a remote-controlled tug in Copenhagen in June 2017.

“We think the initial early adopters will be vessels operating on fixed routes within coastal waters under the jurisdiction of flag states,” the company said.

“We expect to see the first autonomous vessel in commercial operation by the end of the decade. Further out, around 2025, we expect autonomous vessels to operate further from shore — perhaps coastal cargo ships. For ocean-going vessels to be autonomous, it will require a change in international regulations, so this will take longer.”

Once autonomous ships are a reality, “the entire current legal framework for maritime law and insurance is done,” said Johnson. “The master has not been replaced; he is just gone. Commodity ships (bulk carriers) would be most amenable to that technology. I’m not overly bothered by fully automated ships, but I am extremely bothered by heavily automated ones.”

He cited two risks specifically: hacking and fire.

“We expect to see the first autonomous vessel in commercial operation by the end of the decade. Further out, around 2025, we expect autonomous vessels to operate further from shore — perhaps coastal cargo ships. For ocean-going vessels to be autonomous, it will require a change in international regulations, so this will take longer.” — Rolls-Royce Holdings study

Andrew Kinsey, senior marine risk consultant, Allianz Global Corporate & Specialty, asked an even more existential question: “From an insurance standpoint, are we even still talking about a vessel as it is under law? Starting with the legal framework, the duty of a flag state is ‘manning of ships.’ What about the duty to render assistance? There cannot be insurance coverage of an illegal contract.”

Several sources noted that the technological development of crewless ships, while impressive, seems to be a solution in search of a problem. There is no known need in the market; no shippers, operators, owners or mariners advocate that crewless ships will solve their problems.

Kinsey takes umbrage at the suggestion that promotional material on crewless vessels cherry picks his company’s data, which found 75 percent to 90 percent of marine losses are caused by human error.


“Removing the humans from the vessels does not eliminate the human error. It just moves the human error from the helm to the coder. The reports on development by the companies with a vested interest [in crewless vessels] tend to read a lot like advertisements. The pressure for this is not coming from the end users.”

To be sure, Kinsey is a proponent of automation and technology when applied prudently, believing automation can make strides in areas of the supply chains. Much of the talk about automation is trying to bury the serious shortage of qualified crews. It also overshadows the very real potential for blockchain technology to overhaul the backend of marine insurance.

As a marine surveyor, Kinsey said he can go down to the wharf, inspect cranes, vessels and securements, and supervise loading and unloading — but he can’t inspect computer code or cyber security.

New Times, New Risks

In all fairness, insurance language has changed since the 17th century, especially as technology races ahead in the 21st.

“If you read any hull form, it’s practically Shakespearean,” said Stephen J. Harris, senior vice president of marine protection UK, Marsh. “The language is no longer fit for purpose. Our concern specifically to this topic is that the antiquated language talks about crew being on board. If they are not on board, do they still legally count as crew?”

Harris further questioned, “Under hull insurance, and provided that the ship owner has acted diligently, cover is extended to negligence of the master or crew. Does that still apply if the captain is not on board but sitting at a desk in an office?”

Andrew Kinsey, senior marine risk consultant, Allianz Global Corporate & Specialty

Several sources noted that a few international organizations, notably the Comite Maritime International and the International Maritime Organization, “have been very active in asking the legal profession around the world about their thoughts. The interpretations vary greatly. The legal complications of crewless vessels are actually more complicated than the technology.”

For example, if the operational, insurance and regulatory entities in two countries agree on the voyage of a crewless vessel across the ocean, a mishap or storm could drive the vessel into port or on shore of a third country that does not recognize those agreements.

“What worries insurers is legal uncertainty,” said Harris.

“If an operator did everything fine but a system went down, then most likely the designer would be responsible. But even if a designer explicitly accepted responsibility, what matters would be the flag state’s law in international waters and the local state’s law in territorial waters.


“We see the way ahead for this technology as local and short-sea operations. The law has to catch up with the technology, and it is showing no signs of doing so.”

Thomas M. Boudreau, head of specialty insurance, The Hartford, suggested that remote ferry operations could be the most appropriate use: “They travel fixed routes, all within one country’s waters.”

There could also be environmental and operational benefits from using battery power rather than conventional fuels.

“In terms of underwriting, the burden would shift to the manufacturer and designer of the operating systems,” Boudreau added.

It may just be, he suggested, that crewless ships are merely replacing old risks with new ones. Crews can deal with small repairs, fires or leaks at sea, but small conditions such as those can go unchecked and endanger the whole ship and cargo.

“The cyber risk is also concerning. The vessel may be safe from physical piracy, but what about hacking?” &

Gregory DL Morris is an independent business journalist based in New York with 25 years’ experience in industry, energy, finance and transportation. He can be reached at [email protected]