Sponsored: Beecher Carlson

Cyber: A Tale of Two Markets

Inconsistencies in cyber insurance policies can lead to "Swiss cheese towers" of coverage.
By: | March 15, 2017 • 5 min read

You know a risk category is mature when people start to refer to it as “traditional.”

The cyber market is a perfect example. Despite the evolving nature of cyber risk, the industry has developed a set of traditional coverages that are well understood by underwriters and buyers alike.

Those policies include both first- and third-party coverage for well-known risks like privacy liability, breach response costs, cyber extortion and lost revenue from a hack; however, non-traditional risks such as physical damage and bodily injury resulting from a cyber breach or system failure pose new threats and challenges.

The cyber insurance market has been growing at roughly 25 to 30 percent per year and is estimated to reach almost $3 billion in 2017, according to Chris Keegan, National Cyber Practice Leader, Beecher Carlson.

As the cyber market continues to grow, buyers need to gain a better understanding of both their traditional and non-traditional exposures and the coverage they have in place to address them. Meanwhile, the insurance industry is working to develop coordinated solutions to more cohesively address the variety of traditional and emerging cyber risks.

Understanding Exposures beyond Liability

Chris Keegan, National Cyber Practice Leader

Though “cyber liability” is the common term for cyber policies, liability is just the tip of the iceberg of cyber exposure.

“We have a taxonomy problem,” Keegan said. “The term ‘cyber liability’ is misleading because cyber is so much bigger than liability. Cyber is property policies. Cyber is recall policies. Cyber is crime policies. The cyber world encompasses many different risk areas.”

The most prominent cyber risk on risk managers’ minds is usually privacy liability. A breach of employees’ and customers’ personal information – whether through theft or negligence – that results in direct costs of notification, hiring forensics investigators and lawyers, and public relations damage control.

Another high-impact but underestimated cyber exposure is business interruption.

If the server hosting your company website or intranet goes down, how will your business be affected and for how long? What if it’s your cloud provider or the platform where you store data? How many locations will it affect? Not only will a system failure interrupt regular business operations, it can also require rebuilding and replacing any lost data or in some cases hardware.

“You have to understand your exposure first before you even start to think about insurance,” Keegan said.

Models are useful tools that paint a detailed picture of the risk.

“Beecher Carlson’s In-Site suite of models applies to traditional risk exposures like privacy liability and to some non-traditional aspects like cyber property damage,” explains Keegan.

The privacy calculator is a maximum probable loss model based on cost information from the largest breaches, fees charged by breach response vendors, and Beecher Carlson’s independent market research. Those data points are combined to create a calculator that estimates the impact of a breach event.

The business interruption model takes into account all of the immediate extra expenses that come with a breach or failure; it also considers how the impact trickles throughout a company’s various locations. This depends on the type of cyber event. A downed network, for example, may have greater impact than a ransomware attack at a specific location.

“You can take all of that information, input the different variables, and see what your maximum loss might be in different scenarios,” Keegan said. “This differs from more traditional business interruption models that focus only on the impact to specific locations.”

Assessing exposure means looking at more than just data. Insurance buyers in every industry have to consider the physical damages that can result from a cyber incident as well.

If the code directing robots at a manufacturing plant fails, for example, it could not only damage an expensive piece of machinery, but also damage the goods it’s producing and present a safety risk to workers in the vicinity.

For an energy producer, a malfunction in software controlling the flow of oil through a pipeline can cause it to blow up and pollute the environment. In the auto industry, cyber risk increases as cars become more digitized, opening them to hack via on-board systems that cause malfunctions.

“If a hacker disables the brakes, for example, there will be property damage to the car and bodily injury to the driver, both caused by a cyber event. The end result is a liability back to the auto manufacturer,” Keegan said.

“Some of this can be covered under traditional general liability and property policies, but there is no guarantee. Not every property/casualty market will offer this coverage.”

This inconsistency leads to what Keegan calls “Swiss cheese towers” of coverage, where there may be coverage for cyber-related physical damage at the primary level, but further up the tower there are holes and gaps.

Mind the Tower Gaps

Cyber coverage can be found in a variety of different policies, resulting in both overlaps and gaps in coverage for some exposures.

Buyers are looking for a cohesive, streamlined solution to cover all of their cyber risks efficiently. And underwriters grapple with how to factor in “silent” cyber coverages, which respond to unexpected cyber events that fall outside the scope of risk for which the coverage was originally built.

Once the extent of a risk is understood, buyers should examine their cyber coverage across all of their policies and look for the gaps that need filling.

Increasingly, property/casualty insurers are able to tack cyber coverage onto property programs on a sub-limited basis, but the terms may vary from form to form. Ultimately, new solutions are needed to handle the full capacity of potential cyber-related losses.

“Excess DIC/DIL – or difference in conditions / difference in limits coverage – is one option that’s not yet offered widely by the markets but presents a promising solution,” Keegan said. Excess DIC/ DIL would sit on top of other designated policies and fill in the gaps between those policies.  Broader cyber coverage that includes traditional and non-traditional risks can be coordinated with property and casualty policies when the details of those policies are disclosed.

“This comes back to knowing your exposure. You need to know which policies this coverage should be in excess of in order to be sure it drops down and fills in gaps where it needs to,” Keegan continued.

Luckily, Keegan and other cyber leaders are working on developing more streamlined solutions.

“Technology is changing rapidly,” he said. “To be effective, the insurance that covers it has to adapt just as rapidly.”

To learn more about Beecher Carlson’s Cyber Risk, Cyber Liability practice, visit http://www.beechercarlson.com/services-delivered/cyber-liability.

SponsoredContent

BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Beecher Carlson. The editorial staff of Risk & Insurance had no role in its preparation.




Beecher Carlson is a large account risk management broker that delivers expertise by industry focus and product specialization. We strive to develop new and better technologies to support your business requirements and drive operational excellence.

Property

Insurers Take to the Skies

This year’s hurricane season sees the use of drones and other aerial intelligence gathering systems as insurers seek to estimate claims costs.
By: | November 1, 2017 • 6 min read

For Southern communities, current recovery efforts in the wake of Hurricane Harvey will recall the painful devastation of 2005, when Katrina and Wilma struck. But those who look skyward will notice one conspicuous difference this time around: drones.

Advertisement




Much has changed since Katrina and Wilma, both economically and technologically. The insurance industry evolved as well. Drones and other visual intelligence systems (VIS) are set to play an increasing role in loss assessment, claims handling and underwriting.

Farmers Insurance, which announced in August it launched a fleet of drones to enhance weather-related property damage claim assessment, confirmed it deployed its fleet in the aftermath of Harvey.

“The pent-up demand for drones, particularly from a claims-processing standpoint, has been accumulating for almost two years now,” said George Mathew, CEO of Kespry, Farmers’ drone and aerial intelligence platform provider partner.

“The current wind and hail damage season that we are entering is when many of the insurance carriers are switching from proof of concept work to full production rollout.”

 According to Mathew, Farmers’ fleet focused on wind damage in and around Corpus Christi, Texas, at the time of this writing. “Additional work is already underway in the greater Houston area and will expand in the coming weeks and months,” he added.

No doubt other carriers have fleets in the air. AIG, for example, occupied the forefront of VIS since winning its drone operation license in 2015. It deployed drones to inspections sites in the U.S. and abroad, including stadiums, hotels, office buildings, private homes, construction sites and energy plants.

Claims Response

At present, insurers are primarily using VIS for CAT loss assessment. After a catastrophe, access is often prohibited or impossible. Drones allow access for assessing damage over potentially vast areas in a more cost-effective and time-sensitive manner than sending human inspectors with clipboards and cameras.

“Drones improve risk analysis by providing a more efficient alternative to capturing aerial photos from a sky-view. They allow insurers to rapidly assess the scope of damages and provide access that may not otherwise be available,” explained Chris Luck, national practice leader of Advocacy at JLT Specialty USA.

“The pent-up demand for drones, particularly from a claims-processing standpoint, has been accumulating for almost two years now.” — George Mathew, CEO, Kespry

“In our experience, competitive advantage is gained mostly by claims departments and third-party administrators. Having the capability to provide exact measurements and details from photos taken by drones allows insurers to expedite the claim processing time,” he added.

Indeed, as tech becomes more disruptive, insurers will increasingly seek to take advantage of VIS technologies to help them provide faster, more accurate and more efficient insurance solutions.

Duncan Ellis, U.S. property practice leader, Marsh

One way Farmers is differentiating its drone program is by employing its own FAA-licensed drone operators, who are also Farmers-trained claim representatives.

Keith Daly, E.V.P. and chief claims officer for Farmers Insurance, said when launching the program that this sets Farmers apart from most carriers, who typically engage third-party drone pilots to conduct evaluations.

“In the end, it’s all about the experience for the policyholder who has their claim adjudicated in the most expeditious manner possible,” said Mathew.

“The technology should simply work and just melt away into the background. That’s why we don’t just focus on building an industrial-grade drone, but a complete aerial intelligence platform for — in this case — claims management.”

Insurance Applications

Duncan Ellis, U.S. property practice leader at Marsh, believes that, while currently employed primarily to assess catastrophic damage, VIS will increasingly be employed to inspect standard property damage claims.

However, he admitted that at this stage they are better at identifying binary factors such as the area affected by a peril rather than complex assessments, since VIS cannot look inside structures nor assess their structural integrity.

“If a chemical plant suffers an explosion, it might be difficult to say whether the plant is fully or partially out of operation, for example, which would affect a business interruption claim dramatically.

Advertisement




“But for simpler assessments, such as identifying how many houses or industrial units have been destroyed by a tornado, or how many rental cars in a lot have suffered hail damage from a storm, a VIS drone could do this easily, and the insurer can calculate its estimated losses from there,” he said.

In addition,VIS possess powerful applications for pre-loss risk assessment and underwriting. The high-end drones used by insurers can capture not just visual images, but mapping heat, moisture or 3D topography, among other variables.

This has clear applications in the assessment and completion of claims, but also in potentially mitigating risk before an event happens, and pricing insurance accordingly.

“VIS and drones will play an increasing underwriting support role as they can help underwriters get a better idea of the risk — a picture tells a thousand words and is so much better than a report,” said Ellis.

VIS images allow underwriters to see risks in real time, and to visually spot risk factors that could get overlooked using traditional checks or even mature visual technologies like satellites. For example, VIS could map thermal hotspots that could signal danger or poor maintenance at a chemical plant.

Chris Luck, national practice leader of Advocacy, JLT Specialty USA

“Risk and underwriting are very natural adjacencies, especially when high risk/high value policies are being underwritten,” said Mathew.

“We are in a transformational moment in insurance where claims processing, risk management and underwriting can be reimagined with entirely new sources of data. The drone just happens to be one of most compelling of those sources.”

Ellis added that drones also could be employed to monitor supplies in the marine, agriculture or oil sectors, for example, to ensure shipments, inventories and supply chains are running uninterrupted.

“However, we’re still mainly seeing insurers using VIS drones for loss assessment and estimates, and it’s not even clear how extensively they are using drones for that purpose at this point,” he noted.

“Insurers are experimenting with this technology, but given that some of the laws around drone use are still developing and restrictions are often placed on using drones [after] a CAT event, the extent to which VIS is being used is not made overly public.”

Drone inspections could raise liability risks of their own, particularly if undertaken in busy spaces in which they could cause human injury.

Privacy issues also are a potential stumbling block, so insurers are dipping their toes into the water carefully.

Risk Improvement

There is no doubt, however, that VIS use will increase among insurers.

Advertisement




“Although our clients do not have tremendous experience utilizing drones, this technology is beneficial in many ways, from providing security monitoring of their perimeter to loss control inspections of areas that would otherwise require more costly inspections using heavy equipment or climbers,” said Luck.

In other words, drones could help insurance buyers spot weaknesses, mitigate risk and ultimately win more favorable coverage from their insurers.

“Some risks will see pricing and coverage improvements because the information and data provided by drones will put underwriters at ease and reduce uncertainty,” said Ellis.

The flip-side, he noted, is that there will be fewer places to hide for companies with poor risk management that may have been benefiting from underwriters not being able to access the full picture.

Either way, drones will increasingly help insurers differentiate good risks from bad. In time, they may also help insurance buyers differentiate between carriers, too. &

Antony Ireland is a London-based financial journalist. He can be reached at [email protected]