The cyber insurance market today bears little resemblance to the cyber market of just three years ago.

As cyber risk evolved and expanded —and more organizations grasped their exposures — the demand for coverage rose sharply. Now a dynamic typical of a traditional insurance marketplace is playing out: more carriers and more capital have ushered in a soft market cycle.

This influx of capacity has led to increased competition among carriers, and the overarching theme seems to be more about gaining short-term market share than establishing sustainable portfolios by virtue of thoughtful risk selection. With the threat landscape continuing to deteriorate at a rapid pace, and malicious actors becoming increasingly sophisticated, Jeff Bores, Vice President, Cyber Liability, at Aspen Insurance, has noticed a potentially alarming trend. “There is tremendous pressure on both underwriters and brokers to produce at a high level,” Bores remarked. “The underwriting community is feeling it from their brokering partners, who are in turn feeling it from their clients. The dramatic increase in competition has really led to a relaxation in underwriting scrutiny.”

“We have a duty as underwriters to evaluate each risk on its merits and raise questions about deficiencies we recognize in an applicant’s security posture,” Bores said. “Ultimately, our responsibility is to the risk bearing entities we represent to select the strongest risks. Our ability as underwriters to push back on our brokering partners has a potential trickle-down effect to the client level, where it can apply pressure to applicants to devote additional attention and resources to their security posture. If we fail to bring the deficiencies we recognize to light or just gloss over them, our silence sends a message of positive reinforcement to insureds that their approach to security is sound; that is often not the case, especially in the small and mid-market space.”

Brokers Beware: Choose Your Markets (and Underwriters) Carefully

Jeff Bores, Vice President, Cyber Liability

With multiple Cyber markets from which to choose, brokers and their clients are at a crossroads. They can take the path of least resistance by placing coverage with a less sophisticated market that offers broad coverage without pressing for details on the client’s security posture. Doing so makes a broker’s job easier in the short term, and gets coverage in force more quickly for the client.

But this route bears significant intermediate and long-term risks for both clients and brokers.

“Ultimately, as the threat landscape continues to worsen and client security programs fail to evolve, the gap between the client and malicious actors will likely widen,” Bores remarked. “This will lead to a material increase in losses, which generally translates to increased volatility on the carrier side.”

The best way for an organization to prevent a breach is to have a holistic view of their exposure and employ a thoughtful defense-in-depth based approach to security. One way to evaluate those defenses is by having them reviewed by outside, technical third parties, including the underwriting community.

Underwriters who are able to evaluate the details of a client’s security posture and identify areas for improvement are extremely valuable.

By seeking out underwriters with a deeper knowledge of sound privacy and network security practices, brokers bring greater value to their clients beyond just purchasing an appropriate policy.

The Benefits of Strong Underwriting

Strong underwriting can help to keep security standards high and costs more consistent over time. Asking follow-up questions and selecting quality risks are signs of an underwriter that has technical expertise and longevity in the cyber market.

“Even if the insured has network protections in place like a firewall and an intrusion detection system, the underwriter should be probing for more details,” Bores said. “And they should absolutely be looking into any boxes on the application in which the applicant checked ‘no,’ signaling a lack of security in that area, as the absence of those controls could be detrimental to the client dependent on their operations and exposure basis.”

Failing to follow up or push back on poor controls can foster a sense of complacency for clients, which can be damaging to the individual insureds and financially perilous to the insurance industry in aggregate.

“When underwriters fail to press clients on substandard security measures, it could lead insureds to assume they have sound controls in place. As a result, their behavior remains static while the hackers and cyber criminals remain on the attack and continue to evolve,” Bores said.

Five years (or even one year) down the road, that under-preparedness will likely come back to haunt those insureds and the carriers who cover them. A spate of material losses could then spur a shakeup of the marketplace and trigger a carrier exodus, driving up prices across the market and ultimately leaving companies looking for new, and likely more expensive coverage.

The implications extend beyond the insurance market. Lack of strong and up-to-date system security could have dangerous effects for the financial markets, critical infrastructure, and for national security.

What a Knowledgeable Cyber Underwriter Looks Like

Information security expertise enables underwriters to communicate effectively with clients, including with Chief Information Security Officers or IT Security Directors, who regularly and actively participate in underwriting meetings.

Both Bores and Josh Ladeau, Senior Vice President, Head of U.S. Cyber Risk for Aspen, are Certified Information Systems Security Professionals (CISSP). That industry knowledge allows them to ask the right questions to understand clients’ full breadth of cyber risk, and to know whether a given response is suitable; that can give them an edge over other markets.

“I frequently go to underwriting meetings where there are nine or ten different markets represented, and it’s the same two to three people who are asking specific questions about the risk,” Bores said. “Establishing a dialogue with a client’s privacy and network security professionals is important; not only does it help to establish the security posture of a client, but it also lets those professionals know that we have the capacity to appreciate the security investments made by their organization.”

“I think it’s important, particularly to well-secured clients, that they are partnered with an insurance carrier that understands the nuances of their security policies and controls,” said Bores.

It’s just as important to work with brokers who are equally concerned with the technical aspects of a client’s cyber risk exposure. “We’ve found that when brokers are willing to engage the client along with us, the client is much more likely to pay attention. In that way, we’re able to interact on a deeper level and demonstrate the heightened value we offer.”

As a testament to its dedication to clients who work hard at strengthening their security, Aspen will routinely provide any element of cyber coverage its insureds need, without applying sub-limits.

For U.S.-based clients, Aspen also differentiates itself from the market by offering a concise, plain-English form that brokers can more easily explain to clients. At eight pages in length, it’s half the size of the 15 to 20 pages that has become the industry standard. There are no sub-limits inherent to the base policy form, and some aspects are even offered on an uncapped basis.

“We may not always charge the lowest premiums, but we pride ourselves on the expertise and full support we provide for our clients, in addition to an insurance product of the highest quality. That’s where our value lies,” Bores said.

To learn more about Aspen’s cyber liability products and services, visit https://www.aspen.co/Insurance/Insurance-lines/Financial-and-Professional-Lines/cyber-risk/.

This article is provided for informational purposes only, does not necessarily represent Aspen’s views, and reflects the opinion of the authors in light of market, regulatory and other conditions which may change over time. Aspen does not undertake a duty to update the article.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Aspen Insurance. The editorial staff of Risk & Insurance had no role in its preparation.