3 Insurance Against Cyber Risks
3.1 A General Overview of the Cyber Risks Insurance Market
Most organisations are well aware of the cyber risks posed in today’s business world,
and there has been widespread coverage of the matter in the media. However, one
should not lose sight of the fact that “cyber risk insurance” is a relatively new
product, and this poses several difficulties both for the insurers and assureds.
From perspective of the insurers, the main concern is that the cost of a cyber
attack could be considerably high, given that in most organisations computer
systems are interlinked, so an attacker could access a large number of systems on
the network of a corporation simply by breaching the security system of a single
computer. Therefore, the aggregate damage that can occur as a result of a cyber
attack could be on a massive scale. Furthermore, a cyber attack could potentially
come from anywhere on the network system, making it rather difficult for insurers to
quantify the extent of the risk with geographical limits. It is also no comfort to
insurers that there is very little actuarial data on cyber risks, and the industry has not
yet undertaken any robust modelling exercise on cyber risks.
11 These factors create
two significant problems for insurers. First, it is rather difficult for insurers to assess
the rate of the premium for cyber risks. Secondly, challenges in risk assessment
could potentially limit reinsurers’ capacity/appetite to assume such risks. Perhaps
this explains why cyber insurance could be up to six times more expensive than
property insurance and three times more expensive than liability insurance.
12
From the assured’s perspective, there is confusion about what cover cyber
insurance products actually provide. For example, absence of a “cyber exclusion”
clause in a hull & machinery policy does not mean that the assured will be covered
for recovering or repairing data on the system of the corporation other than computer
systems on board the insured vessel. Similarly, a cyber policy that expressly provides cover against business interruption would not respond to a loss caused as a
result of a war between two states if the policy contains an exclusion for acts of war,
invasion and insurrection. It is often reported that there is a huge amount of
uncertainty for the buyers of cyber insurance as to the scope of the coverage on
offer, which could potentially discourage them from fully participating in the cyber
insurance market.
13
11 See, https://www.genevaassociation.org/sites/default/files/research-topics-document-type/pdf_
public/cyber-risk-10_key_questions.pdf (last tested on 31 December 2018).
12 See, the address of Inga Beale, CEO of Lloyd’s of London, https://www.oecd.org/daf/fin/insur
ance/Unleashing-Potential-Cyber-Insurance-Market-Summary.pdf
(last
tested
on
31 December 2018).
13 See,
https://deloitte.wsj.com/cfo/2018/03/21/cyber-insurance-how-to-address-obstacles-togrowth/ (last tested on 31 December 2018).
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
631
3.1 A General Overview of the Cyber Risks Insurance Market
Most organisations are well aware of the cyber risks posed in today’s business world,
and there has been widespread coverage of the matter in the media. However, one
should not lose sight of the fact that “cyber risk insurance” is a relatively new
product, and this poses several difficulties both for the insurers and assureds.
From perspective of the insurers, the main concern is that the cost of a cyber
attack could be considerably high, given that in most organisations computer
systems are interlinked, so an attacker could access a large number of systems on
the network of a corporation simply by breaching the security system of a single
computer. Therefore, the aggregate damage that can occur as a result of a cyber
attack could be on a massive scale. Furthermore, a cyber attack could potentially
come from anywhere on the network system, making it rather difficult for insurers to
quantify the extent of the risk with geographical limits. It is also no comfort to
insurers that there is very little actuarial data on cyber risks, and the industry has not
yet undertaken any robust modelling exercise on cyber risks.
11 These factors create
two significant problems for insurers. First, it is rather difficult for insurers to assess
the rate of the premium for cyber risks. Secondly, challenges in risk assessment
could potentially limit reinsurers’ capacity/appetite to assume such risks. Perhaps
this explains why cyber insurance could be up to six times more expensive than
property insurance and three times more expensive than liability insurance.
12
From the assured’s perspective, there is confusion about what cover cyber
insurance products actually provide. For example, absence of a “cyber exclusion”
clause in a hull & machinery policy does not mean that the assured will be covered
for recovering or repairing data on the system of the corporation other than computer
systems on board the insured vessel. Similarly, a cyber policy that expressly provides cover against business interruption would not respond to a loss caused as a
result of a war between two states if the policy contains an exclusion for acts of war,
invasion and insurrection. It is often reported that there is a huge amount of
uncertainty for the buyers of cyber insurance as to the scope of the coverage on
offer, which could potentially discourage them from fully participating in the cyber
insurance market.
13
11 See, https://www.genevaassociation.org/sites/default/files/research-topics-document-type/pdf_
public/cyber-risk-10_key_questions.pdf (last tested on 31 December 2018).
12 See, the address of Inga Beale, CEO of Lloyd’s of London, https://www.oecd.org/daf/fin/insur
ance/Unleashing-Potential-Cyber-Insurance-Market-Summary.pdf
(last
tested
on
31 December 2018).
13 See,
https://deloitte.wsj.com/cfo/2018/03/21/cyber-insurance-how-to-address-obstacles-togrowth/ (last tested on 31 December 2018).
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
631