Sponsored Content by Nationwide

The Rapid Evolution of Cyber Threats

As technology grows more sophisticated, so do hackers. Insurers must do their best to adapt and keep up.
By: | June 7, 2017 • 6 min read

It seems like only yesterday that the biggest cyber threat was the theft of credit card information. And in fact, it was only a few years ago when that was the case.

But recent events show just how quickly the risk has evolved. The ‘WannaCry’ ransomware attack that struck hundreds of companies around the globe in May, causing an estimated $4 billion in total losses, is a testament to how the risk has grown.

Technology forms the backbone of business for companies of every shape and size. The amount of information generated and stored on the Internet is growing exponentially, doubling every few days. And businesses are drawn closer together through reliance on interconnected systems.

As a result, there are more access points than ever for cyber criminals to exploit. System failure can impact multiple parties at a time, and companies of every size and sector are at risk.

As cyber exposures evolve, insurers are doing their best to adapt and keep up.

“We’ve come a long way from the early days when the biggest concern around cyber risk was the protection of credit card information,” said Tom Iorio, Senior Vice President of Management Liability and Specialty, Nationwide.

The Latest Threats: Phishing and Ransomware

Tom Iorio, Senior Vice President of Management Liability and Specialty

Cyber risk initially was a question of network security and data privacy, and it was focused on retailers and financial institutions.

“But now, credit card data has flooded the market and become less valuable for cyber thieves. It’s not worth their time to steal,” Iorio said.

As technology grows more sophisticated, so do hackers. Cyber attackers have turned to new, more lucrative tactics to exploit and profit from companies’ network vulnerabilities.

Social engineering scams and cyber extortion in the form of ransomware have emerged as the second wave of cyber threats.

Social engineering or “phishing” schemes don’t necessarily involve a breach of a company network or any inside access to sensitive data. Rather, phony emails purported to be sent by a senior manager, or others externally, are directed to employees, typically asking them to wire a sum of money into an external account. They can be very believable imitations of the real deal.

“I myself have received three of these “spear phishing” emails,” Iorio said. “They were supposedly sent by my former boss, asking me to pay a claim and deposit money into an external account. But there were a few problems that stuck out. For one thing, I don’t have the capability to wire money out to pay a claim, and my boss would never ask me to do so. There were also technical flaws. The email was misspelled, for example.”

When employees do fall for these tricks, however, companies stand to lose thousands of dollars. An incident like this is more likely to be covered in a crime policy than a cyber policy, since phishing is a form of computer fraud for funds transfer rather than an outright hack of proprietary information.

Cyber extortion in the form of ransomware, on the other hand, involves hijacking a company’s internal system to hold its data hostage, rendering it inaccessible and unusable until a ransom is paid. And it’s a more difficult risk to insure.

“For the sake of protecting their reputations, companies typically like to keep these incidents quiet, resolving them quickly without attracting attention of the press,” Iorio said. “Unlike theft of personally identifiable information, there is no regulatory requirement to report theft by ransomware. There could be many incidents that nobody hears about.”

“Without a solid understanding of the loss history, it’s harder to understand the risk and to write appropriate coverage. But it seems logical that someday soon, cyber and crime policies will be blended to respond to these incidents.”

When cyber attackers look to steal dollars, not just data from their victims, potential targets expand to industries beyond finance and retail. Hospitals, universities and government bodies are some common targets for cyber extortionists.

“These organizations may not have the dollars to devote to hack-proofing their systems. Many hospitals, for example, are nonprofit. They prioritize the services they provide,” Iorio said. Apart from the losses incurred from paying a ransom or fulfilling a fraudulent wire request, these institutions also have to consider the risk of downtime.

Risks on the Horizon

A ransomware attack — or any system failure that halts operations, malicious or otherwise — can incur large business interruption losses. Retailers lose sales if their websites or POS systems go down. Manufacturers lose productivity and fall behind on deadlines if computer-operated machinery fails. For some industries, network downtime can have residual effects for days.

“Airlines offer a good example. If a major airline is hit with a denial-of-service attack, or experiences some other kind of network failure, it may take several days to get planes back to their regular schedule and re-allocate passengers whose flights were cancelled,” Iorio said. “A downtime of just 20 minutes could still cost the airline millions of dollars.  That loss would be a direct result of a cyber event.”

Most cyber policies include coverage for business interruption on a contingent basis. Like first and third party liability for network security, the coverage has become fairly standard.

But as cyber exposures continue to evolve, the question of liability will be up for debate.

Property damage and bodily injury resulting from a cyber event, for example, is on the horizon, especially as the Internet of Things grows.

“IoT comes down to cloud exposure. With so much interconnectivity, and so many access points, the exposure is huge. But there are still questions around where the liability will fall,” Iorio said.

He pointed to autonomous cars. If a car gets hacked and is driven off the road, who is liable? The manufacturer? The software creator? The driver’s auto insurer?

Staying Steady through Changes

“We’re experiencing not just an evolution of cyber risk, but an evolution of cyber coverage. Cyber risk seems to take on new forms all the time, and nobody is certain of what the impact could be,” he said. “But we do know that cyber touches everything, and we as an industry are trying to connect the dots and cover the gaps between other coverages that are related.”

Insurers that are focused on building quality, lasting relationships with clients will be best positioned to weather the changes ahead. As cyber risk intersects with crime, property, general liability and other policies, companies will benefit most from partnering with a carrier that wants to work with them across their whole portfolio.

That way, when a loss occurs, carriers and their clients can work together to decipher what is or is not considered a cyber event and where the coverages lie. That relationship also makes it easier to fine tune the program to meet a company’s specific exposures going forward.

“At Nationwide, we’re very client focused. “We work with the top brokers in the nation and choose our clients wisely and create personal as well as a business relationship,” Iorio said. “When we know we have a quality client, we want to be there for them across their entire portfolio: directors and officers, professional liability, employment practices, crime and cyber.”

“The market may go up and down, but we stay consistent with our clients, and the same is true for cyber. We won’t be in it one day, and out the next.”

To learn more, visit https://www.nationwide.com/business-insurance.jsp.

SponsoredContent

BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Nationwide. The editorial staff of Risk & Insurance had no role in its preparation.




Nationwide, a Fortune 100 company, is one of the largest and strongest diversified insurance and financial services organizations in the U.S. and is rated A+ by both A.M. Best and Standard & Poor’s.

Alternative Energy

A Shift in the Wind

As warranties run out on wind turbines, underwriters gain insight into their long-term costs.
By: | September 12, 2017 • 6 min read

Wind energy is all grown up. It is no longer an alternative, but in some wholesale markets has set the incremental cost of generation.

As the industry has grown, turbine towers have as well. And as the older ones roll out of their warranty periods, there are more claims.

This is a bit of a pinch in a soft market, but it gives underwriters new insight into performance over time — insight not available while manufacturers were repairing or replacing components.

Charles Long, area SVP, renewable energy, Arthur J. Gallagher

“There is a lot of capacity in the wind market,” said Charles Long, area senior vice president for renewable energy at broker Arthur J. Gallagher.

“The segment is still very soft. What we are not seeing is any major change in forms from the major underwriters. They still have 280-page forms. The specialty underwriters have a 48-page form. The larger carriers need to get away from a standard form with multiple endorsements and move to a form designed for wind, or solar, or storage. It is starting to become apparent to the clients that the firms have not kept up with construction or operations,” at renewable energy facilities, he said.

Third-party liability also remains competitive, Long noted.

“The traditional markets are doing liability very well. There are opportunities for us to market to multiple carriers. There is a lot of generation out there, but the bulk of the writing is by a handful of insurers.”

Broadly the market is “still softish,” said Jatin Sharma, head of business development for specialty underwriter G-Cube.

“There has been an increase in some distressed areas, but there has also been some regional firming. Our focus is very much on the technical underwriting. We are also emphasizing standardization, clean contracts. That extends to business interruption, marine transit, and other covers.”

The Blade Problem

“Gear-box maintenance has been a significant issue for a long time, and now with bigger and bigger blades, leading-edge erosion has become a big topic,” said Sharma. “Others include cracking and lightning and even catastrophic blade loss.”

Long, at Gallagher, noted that operationally, gear boxes have been getting significantly better. “Now it is blades that have become a concern,” he said. “Problems include cracking, fraying, splitting.

Advertisement




“In response, operators are using more sophisticated inspection techniques, including flying drones. Those reduce the amount of climbing necessary, reducing risk to personnel as well.”

Underwriters certainly like that, and it is a huge cost saver to the owners, however, “we are not yet seeing that credited in the underwriting,” said Long.

He added that insurance is playing an important role in the development of renewable energy beyond the traditional property, casualty, and liability coverages.

“Most projects operate at lower capacity than anticipated. But they can purchase coverage for when the wind won’t blow or the sun won’t shine. Weather risk coverage can be done in multiple ways, or there can be an actual put, up to a fixed portion of capacity, plus or minus 20 percent, like a collar; a straight over/under.”

As useful as those financial instruments are, the first priority is to get power into the grid. And for that, Long anticipates “aggressive forward moves around storage. Spikes into the system are not good. Grid storage is not just a way of providing power when the wind is not blowing; it also acts as a shock absorber for times when the wind blows too hard. There are ebbs and flows in wind and solar so we really need that surge capacity.”

Long noted that there are some companies that are storage only.

“That is really what the utilities are seeking. The storage company becomes, in effect, just another generator. It has its own [power purchase agreement] and its own interconnect.”

“Most projects operate at lower capacity than anticipated. But they can purchase coverage for when the wind won’t blow or the sun won’t shine.”  —Charles Long, area senior vice president for renewable energy, Arthur J. Gallagher

Another trend is co-location, with wind and solar, as well as grid-storage or auxiliary generation, on the same site.

“Investors like it because it boosts internal rates of return on the equity side,” said Sharma. “But while it increases revenue, it also increases exposure. … You may have a $400 million wind farm, plus a $150 million solar array on the same substation.”

In the beginning, wind turbines did not generate much power, explained Rob Battenfield, senior vice president and head of downstream at JLT Specialty USA.

“As turbines developed, they got higher and higher, with bigger blades. They became more economically viable. There are still subsidies, and at present those subsidies drive the investment decisions.”

For example, some non-tax paying utilities are not eligible for the tax credits, so they don’t invest in new wind power. But once smaller companies or private investors have made use of the credits, the big utilities are likely to provide a ready secondary market for the builders to recoup their capital.

That structure also affects insurance. More PPAs mandate grid storage for intermittent generators such as wind and solar. State of the art for such storage is lithium-ion batteries, which have been prone to fires if damaged or if they malfunction.

“Grid storage is getting larger,” said Battenfield. “If you have variable generation you need to balance that. Most underwriters insure generation and storage together. Project leaders may need to have that because of non-recourse debt financing. On the other side, insurers may be syndicating the battery risk, but to the insured it is all together.”

“Grid storage is getting larger. If you have variable generation you need to balance that.” — Rob Battenfield, senior vice president, head of downstream, JLT Specialty USA

There has also been a mechanical and maintenance evolution along the way. “The early-generation short turbines were throwing gears all the time,” said Battenfield.

But now, he said, with fewer manufacturers in play, “the blades, gears, nacelles, and generators are much more mechanically sound and much more standardized. Carriers are more willing to write that risk.”

There is also more operational and maintenance data now as warranties roll off. Battenfield suggested that the door started to open on that data three or four years ago, but it won’t stay open forever.

“When the equipment was under warranty, it would just be repaired or replaced by the manufacturer,” he said.

“Now there’s more equipment out of warranty, there are more claims. However, if the big utilities start to aggregate wind farms, claims are likely to drop again. That is because the utilities have large retentions, often about $5 million. Claims and premiums are likely to go down for wind equipment.”

Advertisement




Repair costs are also dropping, said Battenfield.

“An out-of-warranty blade set replacement can cost $300,000. But if it is repairable by a third party, it could cost as little as $30,000 to have a specialist in fiberglass do it in a few days.”

As that approach becomes more prevalent, business interruption (BI) coverage comes to the fore. Battenfield stressed that it is important for owners to understand their PPA obligations, as well as BI triggers and waiting periods.

“The BI challenge can be bigger than the property loss,” said Battenfield. “It is important that coverage dovetails into the operator’s contractual obligations.” &

Gregory DL Morris is an independent business journalist based in New York with 25 years’ experience in industry, energy, finance and transportation. He can be reached at [email protected]