Cyber Coverage

Navigating the Minefield

From gaps in coverage to confusing terminology and hidden exclusions, choosing the right stand-alone cyber policy is a complex and challenging process.
By: | February 20, 2017 • 7 min read

Over the past two decades, traditional lines, from GL to crime to property, have increasingly included some form of cyber cover as standard, while cyber underwriters have done their best to sculpt stand-alone policies that react to the evolving nature of both the risk and client demands. But for those seeking to buy their first stand-alone cyber policies, the landscape can be daunting.

Cyber specialist Lynda Bennett, chair of the insurance practice for law firm Lowenstein Sandler, described the increasingly crowded stand-alone cyber market as a “minefield” in which terminology, exclusions, terms and conditions can “vary wildly” from form to form.

Lynda Bennett, insurance practice chair, Lowenstein Sandler

“We are asked to review cyber policies because they can be unbelievably complex. While the appetite and demand is there for coverage, the nature of the risk is in flux and insurers are having as much trouble pinning down what risk they are willing to insure as risk managers are trying to work out what risks they need insurance for,” she said.

“Each year the traditional industry tweaks its exclusions to push buyers into a dedicated cyber policy. Then they are left in the Wild West having to negotiate a new policy,” said Bennett.

Marsh’s cyber product leader Bob Parisi believes that consistency of approach is appearing in tranches of the industry — such as underwriters who wish to write primary versus those who write excess, those who favor large companies over SMEs, and those who focus on privacy/liability versus those who underwrite direct first-party losses.

According to Jason Glasgow, vice president and practice lead for technology, privacy and network security professional liability with Allied World U.S., it is mainly terminology, not coverage, which sets most of today’s cyber policies apart. But there is no doubt first-time buyers can easily find themselves inadequately covered if they’re not careful.

Mind the Gap

Once predominantly serving to protect customer-facing sectors against data privacy breaches, the scope of cyber cover has expanded into many new areas including property damage, business interruption (BI) and bodily harm. Cobbling together adequate cyber coverage between traditional property, GL and crime policies is increasingly challenging.

Advertisement




However, buying stand-alone cyber cover is not a magic bullet; sources all agree that gaps in coverage may still remain — particularly as far as property and BI are concerned.

Many underwriters are cautious, treating every applicant as “the virtual equivalent of a stilt house on the Gulf Coast.” — Bob Parisi, managing director, Marsh FINPRO

“BI cover in the cyber space is growing but is still limited,” said Parisi. “A risk manager who knows what their property policy would pay out on a loss due to fire would find the BI cover in a cyber policy looks like property language but doesn’t truly mirror the way a property policy deals with a loss.

“Cyber focuses mainly on the IT side, nonphysical perils, and is missing around two-thirds of what a traditional property policy would cover for physical peril,” he said.

“The challenge facing cyber underwriters is how to bridge the gap between where traditional P&C forms leave off and the current cyber wordings begin. Clients don’t care what ‘silo’ the insurance market decides to place the risk in, just that it is covered.”

Bob Parisi, managing director, Marsh FINPRO

A lack of loss history, fears over risk aggregation and uncertainty over how companies will react to cyber-triggered BI events mean many underwriters are cautious, treating every applicant as “the virtual equivalent of a stilt house on the Gulf Coast,” Parisi added.

Waiting periods are one area of concern in cyber BI policies. According to Kevin Harding, partner at RGL Forensics, typical cyber insurance policies include a waiting period of four to 12 hours before BI cover begins to apply. Depending on the nature of the cyber event or the business, this means anything from none to most of the sales loss could fall within the waiting period and therefore not be covered.

“To avoid this situation, and give more certainty to both the insurer and policyholder, we feel either a fixed monetary deductible or possibly a franchise deductible could be adopted,” he said.

“Once the losses are in excess of the defined monetary amount, both parties know what will be paid and no hourly calculation is required.”

However, Harding noted, insurers would need a lot more information about the value of the potential exposures at the time of underwriting the policy to determine the deductible values.

Terrorism is another “area of discomfort” for policyholders and insurers, with Bennett arguing that the definition of what constitutes a terrorism trigger is even vaguer under a cyber policy than other policy forms. “Several recent losses are speculated to be politically motivated, but many cyber policies exclude terrorism whether it is declared or undeclared as a terrorist act, leaving insureds on uncertain ground and heading towards coverage disputes with their insurers.”

Collaborative Approach

Buying stand-alone cyber property or BI cover needs to be carefully woven into a company’s overall program. Certain serious property damage coverages may be best off under a property policy that is likely to have greater limits and a different pricing scheme than a cyber policy, Glasgow said.

“Clients may not want their cyber policy to erode limits in their crime, E&O, D&O or property policies — they have those limits in place for a reason and need to maintain separate limits to ensure proper coverage,” he said.

Further, when two or more policies provide overlapping first-party property coverage it can create an uncertain outcome if a loss occurs, as each insurance policy will likely contain ‘other Insurance’ provisions that make each of them excess to the other.

“Each year the traditional industry tweaks its exclusions to push buyers into a dedicated cyber policy. Then they are left in the Wild West having to negotiate a new policy.” — Lynda Bennett, insurance practice chair, Lowenstein Sandler

“This has the potential to lead to uncertainty at the worst possible time — after the loss has happened,” said Grace Ries, head of cyber risk insurance products at FM Global, whose new product, “Cyber Optimal Recovery,” allows clients to position their property policies to maximize recovery alongside cyber or designate property as primary in order to preserve the cyber policy’s non-property limit.

Steve Anderson, cyber liability product executive at QBE, said some of the next steps in cyber product development are likely to include micro insurance, artificial intelligence and Internet of Things liability coverages, as well as cyber “all risk” policies — though only if the industry can come to grips with potential risk aggregation.

Beazley has taken a step in that direction, partnering with Munich Re to offer what it terms “holistic” cyber cover — catastrophic limits (up to $100 million at present) and broad coverage against virtually any type of cyber loss.

This type of cover can be bought either as primary to any other type of cover, or to dovetail around existing policies — the latter approach requiring a collaborative approach. According to Paul Bantick, Beazley’s leader for technology, media and business, the specialty insurer is seeing huge demand for the product and is already working with about 50 large corporate clients to design holistic programs.

Advertisement




But, noted Jill Salmon, head of cyber/tech/MPL at Berkshire Hathaway Specialty Insurance: “If we are going to start writing holistic programs, broadening cover to include social engineering, crime coverages and property damage, or expanding cover to nonsecurity breach triggers such as system failure, this is not necessarily what cyber underwriters have grown up understanding, so broadening expertise in cyber is critical, as is working collaboratively with experts in other lines of insurance.”

For this reason, Salmon and others believe cyber still has a future within traditional lines such as property and crime, as well as other lines of coverage. “Cyber is a cross-line coverage. As other lines recognize cyber events as a cause of loss, they will have to integrate the cyber discipline,” she said.

With cyber products and inclusions only set to proliferate further, employing a specialist cyber broker is essential.

A good broker will not only help the client better understand what the most appropriate coverages are for their exposures, but can also negotiate better terms from carriers and in the case of bigger players may have already negotiated a degree of cross-carrier standardization of wordings through its work with other clients.

Holistic coverages may go some way toward simplifying the process for large firms, but for the majority, the future may hold an even wider choice of options as cyber grows both stand-alone and as a component of a wider array of covers.

Getting expert advice is an essential tool to help navigate the market. &

Antony Ireland is a London-based financial journalist. He can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Cyber Liability

Fresh Worries for Boards of Directors

New cyber security regulations increase exposure for directors and officers at financial institutions.
By: | June 1, 2017 • 6 min read

Boards of directors could face a fresh wave of directors and officers (D&O) claims following the introduction of tough new cybersecurity rules for financial institutions by The New York State Department of Financial Services (DFS).

Advertisement




Prompted by recent high profile cyber attacks on JPMorgan Chase, Sony, Target, and others, the state regulations are the first of their kind and went into effect on March 1.

The new rules require banks, insurers and other financial institutions to establish an enterprise-wide cybersecurity program and adopt a written policy that must be reviewed by the board and approved by a senior officer annually.

The regulation also requires the more than 3,000 financial services firms operating in the state to appoint a chief information security officer to oversee the program, to report possible breaches within 72 hours, and to ensure that third-party vendors meet the new standards.

Companies will have until September 1 to comply with most of the new requirements, and beginning February 15, 2018, they will have to submit an annual certification of compliance.

The responsibility for cybersecurity will now fall squarely on the board and senior management actively overseeing the entity’s overall program. Some experts fear that the D&O insurance market is far from prepared to absorb this risk.

“The new rules could raise compliance risks for financial institutions and, in turn, premiums and loss potential for D&O insurance underwriters,” warned Fitch Ratings in a statement. “If management and directors of financial institutions that experience future cyber incidents are subsequently found to be noncompliant with the New York regulations, then they will be more exposed to litigation that would be covered under professional liability policies.”

D&O Challenge

Judy Selby, managing director in BDO Consulting’s technology advisory services practice, said that while many directors and officers rely on a CISO to deal with cybersecurity, under the new rules the buck stops with the board.

“The common refrain I hear from directors and officers is ‘we have a great IT guy or CIO,’ and while it’s important to have them in place, as the board, they are ultimately responsible for cybersecurity oversight,” she said.

William Kelly, senior vice president, underwriting, Argo Pro

William Kelly, senior vice president, underwriting at Argo Pro, said that unknown cyber threats, untested policy language and developing case laws would all make it more difficult for the D&O market to respond accurately to any such new claims.

“Insurers will need to account for the increased exposures presented by these new regulations and charge appropriately for such added exposure,” he said.

Going forward, said Larry Hamilton, partner at Mayer Brown, D&O underwriters also need to scrutinize a company’s compliance with the regulations.

“To the extent that this risk was not adequately taken into account in the first place in the underwriting of in-force D&O policies, there could be unanticipated additional exposure for the D&O insurers,” he said.

Michelle Lopilato, Hub International’s director of cyber and technology solutions, added that some carriers may offer more coverage, while others may pull back.

“How the markets react will evolve as we see how involved the department becomes in investigating and fining financial institutions for noncompliance and its result on the balance sheet and dividends,” she said.

Christopher Keegan, senior managing director at Beecher Carlson, said that by setting a benchmark, the new rules would make it easier for claimants to make a case that the company had been negligent.

“If stock prices drop, then this makes it easier for class action lawyers to make their cases in D&O situations,” he said. “As a result, D&O carriers may see an uptick in cases against their insureds and an easier path for plaintiffs to show that the company did not meet its duty of care.”

Advertisement




One area that regulators and plaintiffs might seize upon is the certification compliance requirement, according to Rob Yellen, executive vice president, D&O and fiduciary liability product leader, FINEX at Willis Towers Watson.

“A mere inaccuracy in a certification could result in criminal enforcement, in which case it would then become a boardroom issue,” he said.

A big grey area, however, said Shiraz Saeed, national practice leader for cyber risk at Starr Companies, is determining if a violation is a cyber or management liability issue in the first place.

“The complication arises when a company only has D&O coverage, but it doesn’t have a cyber policy and then they have to try and push all the claims down the D&O route, irrespective of their nature,” he said.

“Insurers, on their part, will need to account for the increased exposures presented by these new regulations and charge appropriately for such added exposure.” — William Kelly, senior vice president, underwriting, Argo Pro

Jim McCue, managing director at Aon’s financial services group, said many small and mid-size businesses may struggle to comply with the new rules in time.

“It’s going to be a steep learning curve and a lot of work in terms of preparedness and the implementation of a highly detailed cyber security program, risk assessment and response plan, all by September 2017,” he said.

The new regulation also has the potential to impact third parties including accounting, law, IT and even maintenance and repair firms who have access to a company’s information systems and personal data, said Keegan.

“That can include everyone from IT vendors to the people who maintain the building’s air conditioning,” he said.

New Models

Others have followed New York’s lead, with similar regulations being considered across federal, state and non-governmental regulators.

The National Association of Insurance Commissioners’ Cyber-security Taskforce has proposed an insurance data security model law that establishes exclusive standards for data security and investigation, and notification of a breach of data security for insurance providers.

Once enacted, each state would be free to adopt the new law, however, “our main concern is if regulators in different states start to adopt different standards from each other,” said Alex Hageli, director, personal lines policy at the Property Casualty Insurers Association of America.

“It would only serve to make compliance harder, increase the cost of burden on companies, and at the end of the day it doesn’t really help anybody.”

Advertisement




Richard Morris, partner at law firm Herrick, Feinstein LLP, said companies need to review their current cybersecurity program with their chief technology officer or IT provider.

“Companies should assess whether their current technology budget is adequate and consider what investments will be required in 2017 to keep up with regulatory and market expectations,” he said. “They should also review and assess the adequacy of insurance policies with respect to coverages, deductibles and other limitations.”

Adam Hamm, former NAIC chair and MD of Protiviti’s risk and compliance practice, added: “With New York’s new cyber regulation, this is a sea change from where we were a couple of years ago and it’s soon going to become the new norm for regulating cyber security.” &

Alex Wright is a U.K.-based business journalist, who previously was deputy business editor at The Royal Gazette in Bermuda. You can reach him at [email protected]