Sponsored: Aspen Insurance

The Path of Least Resistance Is Leading Clients in the Wrong Direction

The relaxed underwriting characteristic of a soft market, paired with an evolving risk like cyber, can spell trouble for brokers and clients.
By: | July 12, 2017 • 6 min read

The cyber insurance market today bears little resemblance to the cyber market of just three years ago.

As cyber risk evolved and expanded —and more organizations grasped their exposures — the demand for coverage rose sharply. Now a dynamic typical of a traditional insurance marketplace is playing out: more carriers and more capital have ushered in a soft market cycle.

This influx of capacity has led to increased competition among carriers, and the overarching theme seems to be more about gaining short-term market share than establishing sustainable portfolios by virtue of thoughtful risk selection. With the threat landscape continuing to deteriorate at a rapid pace, and malicious actors becoming increasingly sophisticated, Jeff Bores, Vice President, Cyber Liability, at Aspen Insurance, has noticed a potentially alarming trend. “There is tremendous pressure on both underwriters and brokers to produce at a high level,” Bores remarked. “The underwriting community is feeling it from their brokering partners, who are in turn feeling it from their clients. The dramatic increase in competition has really led to a relaxation in underwriting scrutiny.”

“We have a duty as underwriters to evaluate each risk on its merits and raise questions about deficiencies we recognize in an applicant’s security posture,” Bores said. “Ultimately, our responsibility is to the risk bearing entities we represent to select the strongest risks. Our ability as underwriters to push back on our brokering partners has a potential trickle-down effect to the client level, where it can apply pressure to applicants to devote additional attention and resources to their security posture. If we fail to bring the deficiencies we recognize to light or just gloss over them, our silence sends a message of positive reinforcement to insureds that their approach to security is sound; that is often not the case, especially in the small and mid-market space.”

Brokers Beware: Choose Your Markets (and Underwriters) Carefully

Jeff Bores, Vice President, Cyber Liability

With multiple Cyber markets from which to choose, brokers and their clients are at a crossroads. They can take the path of least resistance by placing coverage with a less sophisticated market that offers broad coverage without pressing for details on the client’s security posture. Doing so makes a broker’s job easier in the short term, and gets coverage in force more quickly for the client.

But this route bears significant intermediate and long-term risks for both clients and brokers.

“Ultimately, as the threat landscape continues to worsen and client security programs fail to evolve, the gap between the client and malicious actors will likely widen,” Bores remarked. “This will lead to a material increase in losses, which generally translates to increased volatility on the carrier side.”

The best way for an organization to prevent a breach is to have a holistic view of their exposure and employ a thoughtful defense-in-depth based approach to security. One way to evaluate those defenses is by having them reviewed by outside, technical third parties, including the underwriting community.

Underwriters who are able to evaluate the details of a client’s security posture and identify areas for improvement are extremely valuable.

By seeking out underwriters with a deeper knowledge of sound privacy and network security practices, brokers bring greater value to their clients beyond just purchasing an appropriate policy.

The Benefits of Strong Underwriting

Strong underwriting can help to keep security standards high and costs more consistent over time. Asking follow-up questions and selecting quality risks are signs of an underwriter that has technical expertise and longevity in the cyber market.

“Even if the insured has network protections in place like a firewall and an intrusion detection system, the underwriter should be probing for more details,” Bores said. “And they should absolutely be looking into any boxes on the application in which the applicant checked ‘no,’ signaling a lack of security in that area, as the absence of those controls could be detrimental to the client dependent on their operations and exposure basis.”

Failing to follow up or push back on poor controls can foster a sense of complacency for clients, which can be damaging to the individual insureds and financially perilous to the insurance industry in aggregate.

“When underwriters fail to press clients on substandard security measures, it could lead insureds to assume they have sound controls in place. As a result, their behavior remains static while the hackers and cyber criminals remain on the attack and continue to evolve,” Bores said.

Five years (or even one year) down the road, that under-preparedness will likely come back to haunt those insureds and the carriers who cover them. A spate of material losses could then spur a shakeup of the marketplace and trigger a carrier exodus, driving up prices across the market and ultimately leaving companies looking for new, and likely more expensive coverage.

The implications extend beyond the insurance market. Lack of strong and up-to-date system security could have dangerous effects for the financial markets, critical infrastructure, and for national security.

What a Knowledgeable Cyber Underwriter Looks Like

Information security expertise enables underwriters to communicate effectively with clients, including with Chief Information Security Officers or IT Security Directors, who regularly and actively participate in underwriting meetings.

Both Bores and Josh Ladeau, Senior Vice President, Head of U.S. Cyber Risk for Aspen, are Certified Information Systems Security Professionals (CISSP). That industry knowledge allows them to ask the right questions to understand clients’ full breadth of cyber risk, and to know whether a given response is suitable; that can give them an edge over other markets.

“I frequently go to underwriting meetings where there are nine or ten different markets represented, and it’s the same two to three people who are asking specific questions about the risk,” Bores said. “Establishing a dialogue with a client’s privacy and network security professionals is important; not only does it help to establish the security posture of a client, but it also lets those professionals know that we have the capacity to appreciate the security investments made by their organization.”

“I think it’s important, particularly to well-secured clients, that they are partnered with an insurance carrier that understands the nuances of their security policies and controls,” said Bores.

It’s just as important to work with brokers who are equally concerned with the technical aspects of a client’s cyber risk exposure. “We’ve found that when brokers are willing to engage the client along with us, the client is much more likely to pay attention. In that way, we’re able to interact on a deeper level and demonstrate the heightened value we offer.”

As a testament to its dedication to clients who work hard at strengthening their security, Aspen will routinely provide any element of cyber coverage its insureds need, without applying sub-limits.

For U.S.-based clients, Aspen also differentiates itself from the market by offering a concise, plain-English form that brokers can more easily explain to clients. At eight pages in length, it’s half the size of the 15 to 20 pages that has become the industry standard. There are no sub-limits inherent to the base policy form, and some aspects are even offered on an uncapped basis.

“We may not always charge the lowest premiums, but we pride ourselves on the expertise and full support we provide for our clients, in addition to an insurance product of the highest quality. That’s where our value lies,” Bores said.

To learn more about Aspen’s cyber liability products and services, visit https://www.aspen.co/Insurance/Insurance-lines/Financial-and-Professional-Lines/cyber-risk/.

This article is provided for informational purposes only, does not necessarily represent Aspen’s views, and reflects the opinion of the authors in light of market, regulatory and other conditions which may change over time. Aspen does not undertake a duty to update the article.

SponsoredContent
BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Aspen Insurance. The editorial staff of Risk & Insurance had no role in its preparation.




Aspen Insurance is a business segment of Aspen Insurance Holdings Limited.

Risk Management

The Profession

After 20 years in the business, Navy Pier’s Director of Risk Management values her relationships in the industry more than ever.
By: | June 1, 2017 • 4 min read

R&I: What was your first job?

Working at Dominick’s Finer Foods bagging groceries. Shortly after I was hired, I was promoted to [cashier] and then to a management position. It taught me great responsibility and it helped me develop the leadership skills I still carry today.

R&I: How did you come to work in risk management?

While working for Hyatt Regency McCormick Place Hotel, one of my responsibilities was to oversee the administration of claims. This led to a business relationship with the director of risk management of the organization who actually owned the property. Ultimately, a position became available in her department and the rest is history.

R&I: What is the risk management community doing right?

Advertisement




The risk management community is doing a phenomenal job in professional development and creating great opportunities for risk managers to network. The development of relationships in this industry is vitally important and by providing opportunities for risk managers to come together and speak about their experiences and challenges is what enables many of us to be able to do our jobs even more effectively.

R&I: What could the risk management community be doing a better job of?

Attracting, educating and retaining young talent. There is this preconceived notion that the insurance industry and risk management are boring and there could be nothing further from the truth.

R&I: What’s been the biggest change in the risk management and insurance industry since you’ve been in it?

In my 20 years in the industry, the biggest change in risk management and the insurance industry are the various types of risk we look to insure against. Many risks that exist today were not even on our radar 20 years ago.

Gina Kirchner, director of risk management, Navy Pier Inc.

R&I: What insurance carrier do you have the highest opinion of?

FM Global. They have been our property carrier for a great number of years and in my opinion are the best in the business.

R&I: Are you optimistic about the US economy or pessimistic and why?

I am optimistic that policies will be put in place with the new administration that will be good for the economy and business.

R&I: What emerging commercial risk most concerns you?

Advertisement




The commercial risks that are of most concern to me are cyber risks, business interruption, and any form of a health epidemic on a global scale. We are dealing with new exposures and new risks that we are truly not ready for.

R&I: Who is your mentor and why?

My mother has played a significant role in shaping my ideals and values. She truly instilled a very strong work ethic in me. However, there are many men and women in business who have mentored me and have had a significant impact on me and my career as well.

R&I: What have you accomplished that you are proudest of?

I am most proud of making the decision a couple of years ago to return to school and obtain my [MBA]. It took a lot of prayer, dedication and determination to accomplish this while still working a full time job, being involved in my church, studying abroad and maintaining a household.

R&I: What is your favorite book or movie?

“Heaven Is For Real” by Todd Burpo and Lynn Vincent. I loved the book and the movie.

R&I: What’s the best restaurant you’ve ever eaten at?

Advertisement




A French restaurant in Paris, France named Les Noces de Jeannette Restaurant à Paris. It was the most amazing food and brings back such great memories.

R&I: What is the most unusual/interesting place you have ever visited?

Israel. My husband and I just returned a few days ago and spent time in Jerusalem, Nazareth, Jericho and Jordan. It was an absolutely amazing experience. We did everything from riding camels to taking boat rides on the Sea of Galilee to attending concerts sitting on the Temple steps. The trip was absolutely life changing.

R&I: What is the riskiest activity you ever engaged in?

Many, many years ago … I went parasailing in the Caribbean. I had a great experience and didn’t think about the risk at the time because I was young, single and free. Looking back, I don’t know that I would make the same decision today.

R&I: What about this work do you find the most fulfilling or rewarding?

I would have to say the relationships and partnerships I have developed with insurance carriers, brokers and other professionals in the industry. To have wonderful working relationships with such a vast array of talented individuals who are so knowledgeable and to have some of those relationships develop into true friendships is very rewarding.

R&I: What do your friends and family think you do?

My friends and family have a general idea that my position involves claims and insurance. However, I don’t think they fully understand the magnitude of my responsibilities and the direct impact it has on my organization, which experiences more than 9 million visitors a year.




Katie Siegel is an associate editor at Risk & Insurance®. She can be reached at [email protected]