2222222222

Cyber Coverage

Navigating the Minefield

From gaps in coverage to confusing terminology and hidden exclusions, choosing the right stand-alone cyber policy is a complex and challenging process.
By: | February 20, 2017 • 7 min read

Over the past two decades, traditional lines, from GL to crime to property, have increasingly included some form of cyber cover as standard, while cyber underwriters have done their best to sculpt stand-alone policies that react to the evolving nature of both the risk and client demands. But for those seeking to buy their first stand-alone cyber policies, the landscape can be daunting.

Cyber specialist Lynda Bennett, chair of the insurance practice for law firm Lowenstein Sandler, described the increasingly crowded stand-alone cyber market as a “minefield” in which terminology, exclusions, terms and conditions can “vary wildly” from form to form.

Lynda Bennett, insurance practice chair, Lowenstein Sandler

“We are asked to review cyber policies because they can be unbelievably complex. While the appetite and demand is there for coverage, the nature of the risk is in flux and insurers are having as much trouble pinning down what risk they are willing to insure as risk managers are trying to work out what risks they need insurance for,” she said.

“Each year the traditional industry tweaks its exclusions to push buyers into a dedicated cyber policy. Then they are left in the Wild West having to negotiate a new policy,” said Bennett.

Marsh’s cyber product leader Bob Parisi believes that consistency of approach is appearing in tranches of the industry — such as underwriters who wish to write primary versus those who write excess, those who favor large companies over SMEs, and those who focus on privacy/liability versus those who underwrite direct first-party losses.

According to Jason Glasgow, vice president and practice lead for technology, privacy and network security professional liability with Allied World U.S., it is mainly terminology, not coverage, which sets most of today’s cyber policies apart. But there is no doubt first-time buyers can easily find themselves inadequately covered if they’re not careful.

Mind the Gap

Once predominantly serving to protect customer-facing sectors against data privacy breaches, the scope of cyber cover has expanded into many new areas including property damage, business interruption (BI) and bodily harm. Cobbling together adequate cyber coverage between traditional property, GL and crime policies is increasingly challenging.

Advertisement




However, buying stand-alone cyber cover is not a magic bullet; sources all agree that gaps in coverage may still remain — particularly as far as property and BI are concerned.

Many underwriters are cautious, treating every applicant as “the virtual equivalent of a stilt house on the Gulf Coast.” — Bob Parisi, managing director, Marsh FINPRO

“BI cover in the cyber space is growing but is still limited,” said Parisi. “A risk manager who knows what their property policy would pay out on a loss due to fire would find the BI cover in a cyber policy looks like property language but doesn’t truly mirror the way a property policy deals with a loss.

“Cyber focuses mainly on the IT side, nonphysical perils, and is missing around two-thirds of what a traditional property policy would cover for physical peril,” he said.

“The challenge facing cyber underwriters is how to bridge the gap between where traditional P&C forms leave off and the current cyber wordings begin. Clients don’t care what ‘silo’ the insurance market decides to place the risk in, just that it is covered.”

Bob Parisi, managing director, Marsh FINPRO

A lack of loss history, fears over risk aggregation and uncertainty over how companies will react to cyber-triggered BI events mean many underwriters are cautious, treating every applicant as “the virtual equivalent of a stilt house on the Gulf Coast,” Parisi added.

Waiting periods are one area of concern in cyber BI policies. According to Kevin Harding, partner at RGL Forensics, typical cyber insurance policies include a waiting period of four to 12 hours before BI cover begins to apply. Depending on the nature of the cyber event or the business, this means anything from none to most of the sales loss could fall within the waiting period and therefore not be covered.

“To avoid this situation, and give more certainty to both the insurer and policyholder, we feel either a fixed monetary deductible or possibly a franchise deductible could be adopted,” he said.

“Once the losses are in excess of the defined monetary amount, both parties know what will be paid and no hourly calculation is required.”

However, Harding noted, insurers would need a lot more information about the value of the potential exposures at the time of underwriting the policy to determine the deductible values.

Terrorism is another “area of discomfort” for policyholders and insurers, with Bennett arguing that the definition of what constitutes a terrorism trigger is even vaguer under a cyber policy than other policy forms. “Several recent losses are speculated to be politically motivated, but many cyber policies exclude terrorism whether it is declared or undeclared as a terrorist act, leaving insureds on uncertain ground and heading towards coverage disputes with their insurers.”

Collaborative Approach

Buying stand-alone cyber property or BI cover needs to be carefully woven into a company’s overall program. Certain serious property damage coverages may be best off under a property policy that is likely to have greater limits and a different pricing scheme than a cyber policy, Glasgow said.

“Clients may not want their cyber policy to erode limits in their crime, E&O, D&O or property policies — they have those limits in place for a reason and need to maintain separate limits to ensure proper coverage,” he said.

Further, when two or more policies provide overlapping first-party property coverage it can create an uncertain outcome if a loss occurs, as each insurance policy will likely contain ‘other Insurance’ provisions that make each of them excess to the other.

“Each year the traditional industry tweaks its exclusions to push buyers into a dedicated cyber policy. Then they are left in the Wild West having to negotiate a new policy.” — Lynda Bennett, insurance practice chair, Lowenstein Sandler

“This has the potential to lead to uncertainty at the worst possible time — after the loss has happened,” said Grace Ries, head of cyber risk insurance products at FM Global, whose new product, “Cyber Optimal Recovery,” allows clients to position their property policies to maximize recovery alongside cyber or designate property as primary in order to preserve the cyber policy’s non-property limit.

Steve Anderson, cyber liability product executive at QBE, said some of the next steps in cyber product development are likely to include micro insurance, artificial intelligence and Internet of Things liability coverages, as well as cyber “all risk” policies — though only if the industry can come to grips with potential risk aggregation.

Beazley has taken a step in that direction, partnering with Munich Re to offer what it terms “holistic” cyber cover — catastrophic limits (up to $100 million at present) and broad coverage against virtually any type of cyber loss.

This type of cover can be bought either as primary to any other type of cover, or to dovetail around existing policies — the latter approach requiring a collaborative approach. According to Paul Bantick, Beazley’s leader for technology, media and business, the specialty insurer is seeing huge demand for the product and is already working with about 50 large corporate clients to design holistic programs.

Advertisement




But, noted Jill Salmon, head of cyber/tech/MPL at Berkshire Hathaway Specialty Insurance: “If we are going to start writing holistic programs, broadening cover to include social engineering, crime coverages and property damage, or expanding cover to nonsecurity breach triggers such as system failure, this is not necessarily what cyber underwriters have grown up understanding, so broadening expertise in cyber is critical, as is working collaboratively with experts in other lines of insurance.”

For this reason, Salmon and others believe cyber still has a future within traditional lines such as property and crime, as well as other lines of coverage. “Cyber is a cross-line coverage. As other lines recognize cyber events as a cause of loss, they will have to integrate the cyber discipline,” she said.

With cyber products and inclusions only set to proliferate further, employing a specialist cyber broker is essential.

A good broker will not only help the client better understand what the most appropriate coverages are for their exposures, but can also negotiate better terms from carriers and in the case of bigger players may have already negotiated a degree of cross-carrier standardization of wordings through its work with other clients.

Holistic coverages may go some way toward simplifying the process for large firms, but for the majority, the future may hold an even wider choice of options as cyber grows both stand-alone and as a component of a wider array of covers.

Getting expert advice is an essential tool to help navigate the market. &

Antony Ireland is a London-based financial journalist. He can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

2018 Risk All Stars

Stop Mitigating Risk. Start Conquering It Like These 2018 Risk All Stars

The concept of risk mastery and ownership, as displayed by the 2018 Risk All Stars, includes not simply seeking to control outcomes but taking full responsibility for them.
By: | September 14, 2018 • 3 min read

People talk a lot about how risk managers can get a seat at the table. The discussion implies that the risk manager is an outsider, striving to get the ear or the attention of an insider, the CEO or CFO.

Advertisement




But there are risk managers who go about things in a different way. And the 2018 Risk All Stars are prime examples of that.

These risk managers put in gear their passion, creativity and perseverance to become masters of a situation, pushing aside any notion that they are anything other than key players.

Goodyear’s Craig Melnick had only been with the global tire maker a few months when Hurricane Harvey dumped a record amount of rainfall on Houston.

Brilliant communication between Melnick and his new teammates gave him timely and valuable updates on the condition of manufacturing locations. Melnick remained in Akron, mastering the situation by moving inventory out of the storm’s path and making sure remediation crews were lined up ahead of time to give Goodyear its best leg up once the storm passed and the flood waters receded.

Goodyear’s resiliency in the face of the storm gave it credibility when it went to the insurance markets later that year for renewals. And here is where we hear a key phrase, produced by Kevin Garvey, one of Goodyear’s brokers at Aon.

“The markets always appreciate a risk manager who demonstrates ownership,” Garvey said, in what may be something of an understatement.

These risk managers put in gear their passion, creativity and perseverance to become masters of a situation, pushing aside any notion that they are anything other than key players.

Dianne Howard, a 2018 Risk All Star and the director of benefits and risk management for the Palm Beach County School District, achieved ownership of $50 million in property storm exposures for the district.

With FEMA saying it wouldn’t pay again for district storm losses it had already paid for, Howard went to the London markets and was successful in getting coverage. She also hammered out a deal in London that would partially reimburse the district if it suffered a mass shooting and needed to demolish a building, like what happened at Sandy Hook in Connecticut.

2018 Risk All Star Jim Cunningham was well-versed enough to know what traditional risk management theories would say when hospitality workers were suffering too many kitchen cuts. “Put a cut-prevention plan in place,” is the traditional wisdom.

But Cunningham, the vice president of risk management for the gaming company Pinnacle Entertainment, wasn’t satisfied with what looked to him like a Band-Aid approach.

Advertisement




Instead, he used predictive analytics, depending on his own team to assemble company-specific data, to determine which safety measures should be used company wide. The result? Claims frequency at the company dropped 60 percent in the first year of his program.

Alumine Bellone, a 2018 Risk All Star and the vice president of risk management for Ardent Health Services, faced an overwhelming task: Create a uniform risk management program when her hospital group grew from 14 hospitals in three states to 31 hospitals in seven.

Bellone owned the situation by visiting each facility right before the acquisition and again right after, to make sure each caregiving population was ready to integrate into a standardized risk management system.

After consolidating insurance policies, Bellone achieved $893,000 in synergies.

In each of these cases, and in more on the following pages, we see examples of risk managers who weren’t just knocking on the door; they were owning the room. &

_________________________________________________________________

Risk All Stars stand out from their peers by overcoming challenges through exceptional problem solving, creativity, clarity of vision and passion.

See the complete list of 2018 Risk All Stars.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]