Cyber Risks A Reinsurer s Perspective on Exposure & Claims. EMEA Claims Conference 2018, Rüschlikon, 6th 7th March, Anthony Cordonnier

Transcription

1 Cyber Risks A Reinsurer s Perspective on Exposure & Claims EMEA Claims Conference 2018, Rüschlikon, 6th 7th March, Anthony Cordonnier

2 Cyber: a claims sprint through the last year (and a bit ) Source: wikipedia.org Source: bleepingcomputer.com Source: Wikipedia.org Source: flyertalk.com Source: businessinsider.com Source: Google.com 2

3 Cyber coverage: trends & challenges 3

4 Cyber coverage landscape Affirmative cyber covers Third party covers Data Privacy Liability First party covers Business Interruption (BI) and Contingent Business Interruption (CBI) Regulatory Defence Data Restoration Communication and Media Liability Network and Information Security Liability Incident Response Costs (might include Notification, Forensics, PR, Monitoring) Cyber Extortion 4

5 Underlying coverage trends System failure coverage (named vs. open perils) Contingent business interruption Cyber creep in GTPL (and other) policies Bodily injury / property damage extensions in cyber policies Lack of standardized wordings Critical infrastructure War Confiscation / seizure 5

6 Traditional treaty reinsurance structures applied to cyber (1/2) Alignment of interests Solvency relief Expenses funding Quota share No protection against large losses Large loss protection Risk XL Accumulation of retentions in case of event hitting multiple insureds 6

7 Traditional treaty reinsurance structures applied to cyber (2/2) Earnings protection Capital relief Aggregate XL Stop loss Lack of alignment of interests Cost One retention in case of large event Event XL Difficulty in defining event Complexity of a line of business that has multiple triggers 7

8 As always, the devil is in the wording Some reinsurance wordings include loose event definitions When determining what shall be considered a single event, the Reinsured may include a single act or a series of related acts, and may consider objective factors including when and where such act(s) are executed, whether they are performed by the same perpetrator, whether they use the same technique or malware, and if they target insureds operating in the same industry segment. Current geopolitical climate is driving a push from brokers to weaken war exclusions War, per the Reinsured's policies. However, this shall not apply to: a. Loss or damage arising out of or caused by an act of terrorism as defined in the Definitions Article; or b. Loss or damage occasioned by riots, strikes, civil commotion, vandalism, malicious damage, including acts committed by agents of any government, party or faction engaged in war, hostilities or other warlike operation, provided such agents are acting secretly and not in connection with any operations of military or naval armed forces in the country where the interests insured are situated. 8

9 Quantifying cyber risks & accumulation 9

10 The traditional actuarial approach Source: Swiss Re Economic Research & Consulting 10

11 The challenges in applying traditional methods to cyber risks Lack of empirical data Lack of historical data Lack common reporting standards for data breaches Lack of understanding of rare & severe risks Fluidity of risk drivers New actors & new attack methods The human element Accumulation potential IT monoculture Cloud services Correlated vulnerabilities 11

12 Cyber accumulation main scenario clusters DDoS / IO (Distributed Denial of Service / Interruption of Operations) Coordinated attack that affects many e-sales portals Attack on clouds Widespread internet outage Data Breach (Impact on personal data) Personal data and credit card data are stolen from several data banks using the same systems Critical Infrastructure (With or without property damage) A virus is blocking the cooling system of several generators that sub sequentially start to burn Malware affecting a transmissions operator leads to a blackout (without property damage) 12

13 Silent cyber 13

14 Silent cyber exposure matters because it constitutes a real risk it s getting on regulators agenda Traditional property insurance policies are expected to cover physical damage and business interruption from incidents like the cyber attack to a German steel mill in 2014 By its nature, silent cyber risk is not always identified, managed and monitored and may be a material risk for firms The PRA expects firms to robustly assess and actively manage their insurance products with specific consideration to silent cyber risk exposure Source: PRA consultation paper CP 39/16 14

15 Unless explicitly excluded, cyber risks might be covered by most conventional insurance policies Extent of cyber risk coverage Affirmative/ explicit Non- affirmative/ silent Partially excluded (e.g. NMA 2914) Fully excluded (e.g. CL 380) Silent cyber exposure: Depending on the scope of insuring agreements, losses caused by cyber perils might be silently covered in most conventional insurance policies Engineering Property General Liability Silent cyber can creep into policies where cyber exclusions are not fully exhaustive Trend towards digitization and new technologies such as IoT, smart homes, autonomous cars are likely to increase silent cyber exposure under conventional lines Marine Silent cyber in E&O Underwriters should carefully assess how silent cyber exposure might impact loss severity and frequency Understanding silent cyber exposures in conventional lines is key to actively manage accumulation Other LoBs Motor D&O 15

16 The limits of insurability 16

17 A world of many threats Our adversaries are becoming more adept at using cyberspace to threaten our interests and advance their own, and despite improving cyber defenses, nearly all information, communication networks, and systems will be at risk for years. Daniel R. Coats, Director of National Intelligence Senate Select Committee on Intelligence, May 2017 What I see frightens me. I am frightened because our enemies are no longer known to us. They do not exist on a map. They are not nations, they are individuals. And look around you. Who do you fear? Can you see a face, a uniform, a flag? Our world is not more transparent now. It is more opaque. It is in the shadows. M, Skyfall 17

18 Criminal acts, terrorism, war: a blurred line Losses arising out of malicious acts committed against an insured Losses arising out of criminal / wilful acts committed by an insured Losses resulting from act of cyber terrorism Losses resulting from act of war 18

19 A few thoughts for the future Role of governments Role of pools Role of financial markets 19

20 20

21 Legal notice 2018 Swiss Re. All rights reserved. You are not permitted to create any modifications or derivative works of this presentation or to use it for commercial or other public purposes without the prior written permission of Swiss Re. The information and opinions contained in the presentation are provided as at the date of the presentation and are subject to change without notice. Although the information used was taken from reliable sources, Swiss Re does not accept any responsibility for the accuracy or comprehensiveness of the details given. All liability for the accuracy and completeness thereof or for any damage or loss resulting from the use of the information contained in this presentation is expressly excluded. Under no circumstances shall Swiss Re or its Group companies be liable for any financial or consequential loss relating to this presentation. 21