The Financial Impact of Cyberattacks Is a Given. Why Your Board Needs to Own a Cybersecurity Focus

By: Lewis Guinard | July 21, 2022

Lewis Guignard is a director at Guidewire Software where he leads the development of cyber risk analytics technologies for the insurance industry. He received his Master’s degree in electrical engineering from Stanford University.

A series of new laws and regulations will transform the impact cyber risk and cybersecurity have on a company’s financial health. And companies must adjust their understanding of cyber risks to protect their financial wellbeing.

As a starting point, companies need to re-examine their in-house cybersecurity expertise and increase the knowledge of senior management and boards of directors in regard to cybersecurity issues.

The Government’s Approach to Cyber

Earlier this year, the Cyber Incident Reporting for Critical Infrastructure Act was signed into law. The act requires companies in broadly defined “critical infrastructure” sectors to report notable cyberattacks and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA), within 24 to 72 hours.

The act was designed to enhance CISA’s ability to track, analyze and respond to cyberattacks.

In addition, just weeks ago, the Better Cybercrime Metrics Act was signed into law. This law is designed to “improve the way the federal government tracks, measures and analyzes cybercrime.”

The law seeks to create a classification system to categorize various cyber crimes, enabling the FBI and security community to obtain a more holistic picture of the cyber threat environment.

In addition, the Securities and Exchange Commission (SEC) is proposing a new rule to require and standardize disclosure of cybersecurity incidents at public companies.

Specifically, the SEC is calling for mandatory public disclosure of material cybersecurity incidents, as well as requiring periodic disclosure of a company’s security policies.

In response to the increasing operational and financial impact of cyber risks — and the increasing regulatory focus — insurance companies, financial institutions, and credit rating agencies are giving increased focus and weight to cyber risk and preparedness.

Even before the new regulations and reporting requirements, some financial institutions and credit rating agencies publicly warned that cyber risk would be a higher area of priority in their analysis going forward.

And while 82% of companies are concerned their company is vulnerable to a cyberattack, 49% of companies lack the expertise for adequate mitigation and incident response, according to Kroll’s “The State of Incident Response 2021” report.

It is evident that companies need to instill greater cyber risk and cybersecurity expertise in their leadership and their boards of directors.

Although the focus and objectives of a board may vary depending on industry, size and other factors, there are consistent underlying components. Financial, audit, risk, operational and strategic concerns are all well represented by board committees and members. Unfortunately, cybersecurity expertise is consistently lacking.

How Is Cyber Addressed

Most commonly, cyber risk and cybersecurity matters are handled by the audit or risk subcommittee of the board.

But this is only because cybersecurity has been shoehorned into an old-world frame, where “audit” and “risk” are treated generically.

Cybersecurity is clearly a very complex and critical topic, so it seems odd that the audit and risk committee would be lacking specific cybersecurity expertise. In such a structure, the board of directors is dependent on getting their cyber security expertise from sources external to the board. Typically, this is accomplished through periodic communications and reporting from the chief information security officer (CISO) or CIO.

This is not an ideal position, considering ransomware and cyber risks are prime operational and financial risks to the business. Cyberattacks can pose a significant risk to business operations.

Cyberattacks increased 31% from 2020 to 2021, according to Accenture’s “State of Cybersecurity Resilience 2021” report. The number of attacks per company increased from about 200 to more than 270 per year. And the cost of cybercrime is predicted to hit $10.5 trillion by 2025, according to the latest version of the Cisco/Cybersecurity Ventures “2022 Cybersecurity Almanac.”

Cyberattacks have the potential to not only interrupt operations and cause reputational damage but also cause significant financial and investment losses whether from theft of money or information or via reputational harm. And the increased required reporting of cyber incidents will increase public, investor and financial institution awareness of cyber impacts and losses.

Business leaders need to ask themselves some questions: Can the board of directors actually do what it’s supposed to do, fulfill its fiduciary duty with regard to cyber risks, given the current state of affairs? Can the board’s risk committee or the audit committee properly account for and understand cyber risk?

Is the current state what you want for your business, for a client who you are insuring, for a company you are investing in or lending to?

What Boards Should Do

Boards of directors need to understand how to account for, evaluate, plan for and mitigate cyber risk.

Currently, most boards rely on the CISO — and from a corporate view, most CISOs are still working in a silo. While the role of the CISO is evolving and has become increasingly indispensable to the business, most boards have not evolved in terms of cybersecurity.

So, as robust enterprise cybersecurity capabilities become a more critical component of the operational and financial health of a company, the C-suite and board are only becoming more reliant on that single CISO’s point of view.

One solution is to inject more CISO-like or security experience into a board, particularly outside CISO experience or governmental security experience. Prior government experience is often viewed as the path towards this expertise, but it’s only one option.

With the addition of board members with increased security experience, the board of directors can better understand and help direct investment where cyber risks exist — and better partner with CIOs and CISOs in understanding risk and the company’s capability to respond and mitigate that risk.

The SEC recently issued several proposed amendments that could have an impact in this area. Amend Item 407(j) of Regulation S-K would “require disclosure about if any member of the registrant’s board of directors has cybersecurity experience.”

This would require disclosure on annual reports, annual meeting proxy statements, and information statements if any of their board members have previous cybersecurity experience and the details necessary to fully describe that expertise.

We’ve all heard the phrase “today every company is a technology company” — and as companies increasingly depend on technology and as risk evolves, boards of directors need to evolve as well. With added CISO and cybersecurity experience available to the board of directors, companies and their shareholders will be better served. &

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.