Cyber Coverage

Navigating the Minefield

From gaps in coverage to confusing terminology and hidden exclusions, choosing the right stand-alone cyber policy is a complex and challenging process.
By: | February 20, 2017 • 7 min read

Over the past two decades, traditional lines, from GL to crime to property, have increasingly included some form of cyber cover as standard, while cyber underwriters have done their best to sculpt stand-alone policies that react to the evolving nature of both the risk and client demands. But for those seeking to buy their first stand-alone cyber policies, the landscape can be daunting.

Cyber specialist Lynda Bennett, chair of the insurance practice for law firm Lowenstein Sandler, described the increasingly crowded stand-alone cyber market as a “minefield” in which terminology, exclusions, terms and conditions can “vary wildly” from form to form.

Lynda Bennett, insurance practice chair, Lowenstein Sandler

“We are asked to review cyber policies because they can be unbelievably complex. While the appetite and demand is there for coverage, the nature of the risk is in flux and insurers are having as much trouble pinning down what risk they are willing to insure as risk managers are trying to work out what risks they need insurance for,” she said.

“Each year the traditional industry tweaks its exclusions to push buyers into a dedicated cyber policy. Then they are left in the Wild West having to negotiate a new policy,” said Bennett.

Marsh’s cyber product leader Bob Parisi believes that consistency of approach is appearing in tranches of the industry — such as underwriters who wish to write primary versus those who write excess, those who favor large companies over SMEs, and those who focus on privacy/liability versus those who underwrite direct first-party losses.

According to Jason Glasgow, vice president and practice lead for technology, privacy and network security professional liability with Allied World U.S., it is mainly terminology, not coverage, which sets most of today’s cyber policies apart. But there is no doubt first-time buyers can easily find themselves inadequately covered if they’re not careful.

Mind the Gap

Once predominantly serving to protect customer-facing sectors against data privacy breaches, the scope of cyber cover has expanded into many new areas including property damage, business interruption (BI) and bodily harm. Cobbling together adequate cyber coverage between traditional property, GL and crime policies is increasingly challenging.

Advertisement




However, buying stand-alone cyber cover is not a magic bullet; sources all agree that gaps in coverage may still remain — particularly as far as property and BI are concerned.

Many underwriters are cautious, treating every applicant as “the virtual equivalent of a stilt house on the Gulf Coast.” — Bob Parisi, managing director, Marsh FINPRO

“BI cover in the cyber space is growing but is still limited,” said Parisi. “A risk manager who knows what their property policy would pay out on a loss due to fire would find the BI cover in a cyber policy looks like property language but doesn’t truly mirror the way a property policy deals with a loss.

“Cyber focuses mainly on the IT side, nonphysical perils, and is missing around two-thirds of what a traditional property policy would cover for physical peril,” he said.

“The challenge facing cyber underwriters is how to bridge the gap between where traditional P&C forms leave off and the current cyber wordings begin. Clients don’t care what ‘silo’ the insurance market decides to place the risk in, just that it is covered.”

Bob Parisi, managing director, Marsh FINPRO

A lack of loss history, fears over risk aggregation and uncertainty over how companies will react to cyber-triggered BI events mean many underwriters are cautious, treating every applicant as “the virtual equivalent of a stilt house on the Gulf Coast,” Parisi added.

Waiting periods are one area of concern in cyber BI policies. According to Kevin Harding, partner at RGL Forensics, typical cyber insurance policies include a waiting period of four to 12 hours before BI cover begins to apply. Depending on the nature of the cyber event or the business, this means anything from none to most of the sales loss could fall within the waiting period and therefore not be covered.

“To avoid this situation, and give more certainty to both the insurer and policyholder, we feel either a fixed monetary deductible or possibly a franchise deductible could be adopted,” he said.

“Once the losses are in excess of the defined monetary amount, both parties know what will be paid and no hourly calculation is required.”

However, Harding noted, insurers would need a lot more information about the value of the potential exposures at the time of underwriting the policy to determine the deductible values.

Terrorism is another “area of discomfort” for policyholders and insurers, with Bennett arguing that the definition of what constitutes a terrorism trigger is even vaguer under a cyber policy than other policy forms. “Several recent losses are speculated to be politically motivated, but many cyber policies exclude terrorism whether it is declared or undeclared as a terrorist act, leaving insureds on uncertain ground and heading towards coverage disputes with their insurers.”

Collaborative Approach

Buying stand-alone cyber property or BI cover needs to be carefully woven into a company’s overall program. Certain serious property damage coverages may be best off under a property policy that is likely to have greater limits and a different pricing scheme than a cyber policy, Glasgow said.

“Clients may not want their cyber policy to erode limits in their crime, E&O, D&O or property policies — they have those limits in place for a reason and need to maintain separate limits to ensure proper coverage,” he said.

Further, when two or more policies provide overlapping first-party property coverage it can create an uncertain outcome if a loss occurs, as each insurance policy will likely contain ‘other Insurance’ provisions that make each of them excess to the other.

“Each year the traditional industry tweaks its exclusions to push buyers into a dedicated cyber policy. Then they are left in the Wild West having to negotiate a new policy.” — Lynda Bennett, insurance practice chair, Lowenstein Sandler

“This has the potential to lead to uncertainty at the worst possible time — after the loss has happened,” said Grace Ries, head of cyber risk insurance products at FM Global, whose new product, “Cyber Optimal Recovery,” allows clients to position their property policies to maximize recovery alongside cyber or designate property as primary in order to preserve the cyber policy’s non-property limit.

Steve Anderson, cyber liability product executive at QBE, said some of the next steps in cyber product development are likely to include micro insurance, artificial intelligence and Internet of Things liability coverages, as well as cyber “all risk” policies — though only if the industry can come to grips with potential risk aggregation.

Beazley has taken a step in that direction, partnering with Munich Re to offer what it terms “holistic” cyber cover — catastrophic limits (up to $100 million at present) and broad coverage against virtually any type of cyber loss.

This type of cover can be bought either as primary to any other type of cover, or to dovetail around existing policies — the latter approach requiring a collaborative approach. According to Paul Bantick, Beazley’s leader for technology, media and business, the specialty insurer is seeing huge demand for the product and is already working with about 50 large corporate clients to design holistic programs.

Advertisement




But, noted Jill Salmon, head of cyber/tech/MPL at Berkshire Hathaway Specialty Insurance: “If we are going to start writing holistic programs, broadening cover to include social engineering, crime coverages and property damage, or expanding cover to nonsecurity breach triggers such as system failure, this is not necessarily what cyber underwriters have grown up understanding, so broadening expertise in cyber is critical, as is working collaboratively with experts in other lines of insurance.”

For this reason, Salmon and others believe cyber still has a future within traditional lines such as property and crime, as well as other lines of coverage. “Cyber is a cross-line coverage. As other lines recognize cyber events as a cause of loss, they will have to integrate the cyber discipline,” she said.

With cyber products and inclusions only set to proliferate further, employing a specialist cyber broker is essential.

A good broker will not only help the client better understand what the most appropriate coverages are for their exposures, but can also negotiate better terms from carriers and in the case of bigger players may have already negotiated a degree of cross-carrier standardization of wordings through its work with other clients.

Holistic coverages may go some way toward simplifying the process for large firms, but for the majority, the future may hold an even wider choice of options as cyber grows both stand-alone and as a component of a wider array of covers.

Getting expert advice is an essential tool to help navigate the market. &

Antony Ireland is a London-based financial journalist. He can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Alternative Energy

A Shift in the Wind

As warranties run out on wind turbines, underwriters gain insight into their long-term costs.
By: | September 12, 2017 • 6 min read

Wind energy is all grown up. It is no longer an alternative, but in some wholesale markets has set the incremental cost of generation.

As the industry has grown, turbine towers have as well. And as the older ones roll out of their warranty periods, there are more claims.

This is a bit of a pinch in a soft market, but it gives underwriters new insight into performance over time — insight not available while manufacturers were repairing or replacing components.

Charles Long, area SVP, renewable energy, Arthur J. Gallagher

“There is a lot of capacity in the wind market,” said Charles Long, area senior vice president for renewable energy at broker Arthur J. Gallagher.

“The segment is still very soft. What we are not seeing is any major change in forms from the major underwriters. They still have 280-page forms. The specialty underwriters have a 48-page form. The larger carriers need to get away from a standard form with multiple endorsements and move to a form designed for wind, or solar, or storage. It is starting to become apparent to the clients that the firms have not kept up with construction or operations,” at renewable energy facilities, he said.

Third-party liability also remains competitive, Long noted.

“The traditional markets are doing liability very well. There are opportunities for us to market to multiple carriers. There is a lot of generation out there, but the bulk of the writing is by a handful of insurers.”

Broadly the market is “still softish,” said Jatin Sharma, head of business development for specialty underwriter G-Cube.

“There has been an increase in some distressed areas, but there has also been some regional firming. Our focus is very much on the technical underwriting. We are also emphasizing standardization, clean contracts. That extends to business interruption, marine transit, and other covers.”

The Blade Problem

“Gear-box maintenance has been a significant issue for a long time, and now with bigger and bigger blades, leading-edge erosion has become a big topic,” said Sharma. “Others include cracking and lightning and even catastrophic blade loss.”

Long, at Gallagher, noted that operationally, gear boxes have been getting significantly better. “Now it is blades that have become a concern,” he said. “Problems include cracking, fraying, splitting.

Advertisement




“In response, operators are using more sophisticated inspection techniques, including flying drones. Those reduce the amount of climbing necessary, reducing risk to personnel as well.”

Underwriters certainly like that, and it is a huge cost saver to the owners, however, “we are not yet seeing that credited in the underwriting,” said Long.

He added that insurance is playing an important role in the development of renewable energy beyond the traditional property, casualty, and liability coverages.

“Most projects operate at lower capacity than anticipated. But they can purchase coverage for when the wind won’t blow or the sun won’t shine. Weather risk coverage can be done in multiple ways, or there can be an actual put, up to a fixed portion of capacity, plus or minus 20 percent, like a collar; a straight over/under.”

As useful as those financial instruments are, the first priority is to get power into the grid. And for that, Long anticipates “aggressive forward moves around storage. Spikes into the system are not good. Grid storage is not just a way of providing power when the wind is not blowing; it also acts as a shock absorber for times when the wind blows too hard. There are ebbs and flows in wind and solar so we really need that surge capacity.”

Long noted that there are some companies that are storage only.

“That is really what the utilities are seeking. The storage company becomes, in effect, just another generator. It has its own [power purchase agreement] and its own interconnect.”

“Most projects operate at lower capacity than anticipated. But they can purchase coverage for when the wind won’t blow or the sun won’t shine.”  —Charles Long, area senior vice president for renewable energy, Arthur J. Gallagher

Another trend is co-location, with wind and solar, as well as grid-storage or auxiliary generation, on the same site.

“Investors like it because it boosts internal rates of return on the equity side,” said Sharma. “But while it increases revenue, it also increases exposure. … You may have a $400 million wind farm, plus a $150 million solar array on the same substation.”

In the beginning, wind turbines did not generate much power, explained Rob Battenfield, senior vice president and head of downstream at JLT Specialty USA.

“As turbines developed, they got higher and higher, with bigger blades. They became more economically viable. There are still subsidies, and at present those subsidies drive the investment decisions.”

For example, some non-tax paying utilities are not eligible for the tax credits, so they don’t invest in new wind power. But once smaller companies or private investors have made use of the credits, the big utilities are likely to provide a ready secondary market for the builders to recoup their capital.

That structure also affects insurance. More PPAs mandate grid storage for intermittent generators such as wind and solar. State of the art for such storage is lithium-ion batteries, which have been prone to fires if damaged or if they malfunction.

“Grid storage is getting larger,” said Battenfield. “If you have variable generation you need to balance that. Most underwriters insure generation and storage together. Project leaders may need to have that because of non-recourse debt financing. On the other side, insurers may be syndicating the battery risk, but to the insured it is all together.”

“Grid storage is getting larger. If you have variable generation you need to balance that.” — Rob Battenfield, senior vice president, head of downstream, JLT Specialty USA

There has also been a mechanical and maintenance evolution along the way. “The early-generation short turbines were throwing gears all the time,” said Battenfield.

But now, he said, with fewer manufacturers in play, “the blades, gears, nacelles, and generators are much more mechanically sound and much more standardized. Carriers are more willing to write that risk.”

There is also more operational and maintenance data now as warranties roll off. Battenfield suggested that the door started to open on that data three or four years ago, but it won’t stay open forever.

“When the equipment was under warranty, it would just be repaired or replaced by the manufacturer,” he said.

“Now there’s more equipment out of warranty, there are more claims. However, if the big utilities start to aggregate wind farms, claims are likely to drop again. That is because the utilities have large retentions, often about $5 million. Claims and premiums are likely to go down for wind equipment.”

Advertisement




Repair costs are also dropping, said Battenfield.

“An out-of-warranty blade set replacement can cost $300,000. But if it is repairable by a third party, it could cost as little as $30,000 to have a specialist in fiberglass do it in a few days.”

As that approach becomes more prevalent, business interruption (BI) coverage comes to the fore. Battenfield stressed that it is important for owners to understand their PPA obligations, as well as BI triggers and waiting periods.

“The BI challenge can be bigger than the property loss,” said Battenfield. “It is important that coverage dovetails into the operator’s contractual obligations.” &

Gregory DL Morris is an independent business journalist based in New York with 25 years’ experience in industry, energy, finance and transportation. He can be reached at [email protected]