This article was produced in partnership with CFC.
Mia Wallace of Insurance Business sat down with Lindsey Nelson, cyber development leader of CFC, to discuss the next steps for the cyber market.
How can you predict the future of a landscape prone to rapid seismic shifts at the drop of a hat? The cyber market is a prime example of one such terrain but the solution, according to CFC’s cyber development leader Lindsey Nelson (pictured), is a response centred on pre-emptive action rather than prediction.
Find out more: Explore CFC’s market-leading cyber insurance proposition
“The cyber market needs to respond and be as dynamic as the threat landscape has proven itself to be over the last few years, as threat actors shift tactics to find new attack vectors and maximise profitability,” she said. “It was only two years ago we were saying that coverage was as broad and as competitively priced as it was ever going to be.
“Fast forward to today and obtaining cyber insurance has become more challenging than ever - particularly as you move up the size spectrum and the conversation has shifted from what clients can adopt to get a better price on their cyber insurance, to what they can implement just to become an insurable risk in the first place.”
While nobody has the crystal ball necessary to foresee what even the next few months will look like, Nelson said, it is clear that, in order to have any longevity and stability as a class of business, cyber insurance needs to quickly evolve to act as a proactive service rather than a reactive incident response policy. Although the market will continue to seek more rate changes in reaction to ransomware losses over the next year, insurers will be equally focused on ensuring their portfolios are resilient against any unanticipated changes in the threat landscape and future systemic losses.
“What that inevitably means for brokers is that stability and consistency of a cyber insurer will be the number one criterion they should look for in where to place their client’s insurance,” she said. “The cyber insurers who are making significant investments into their in-house, technically led, claims solution are going to be the markets best equipped to handle severe ransomware events.
“It’s no longer adequate to have a ransomware event called into an insurer and be triaged by an outsourced legal team – these incidents develop at a rapid pace, require technical assistance, with experienced incident response handlers who know the tactics that work to get a company back up and running operationally.”
Faced with this undulating environment, there are several major pain points currently impacting the cyber market, and Nelson noted that the conundrum is that market demand is at an all-time high while capacity is significantly reduced and much more difficult to obtain. As capacity tightens over the next year, she said, underwriters will become increasingly discerning when it comes to risk selection.
What that ultimately means in practice is that strong security controls are ultimately becoming an expectation from cyber insurers, Nelson said, rather than the basis for a more competitively priced premium. Brokers will be key to ensuring that their clients are preparing well in advance to ensure their clients can become insurable risks.
“Insurers have equally taken a number of different approaches towards their response to a hardening market,” she added. “There is the expectation that there will continue to be withdrawals from cyber as a class of business, reduced appetites for poor performing sectors, and unanimously the recognition that the price hasn’t historically been right, and readjustments will continue to be made for that.”
The CFC team’s key commitment is to keeping its cyber product as broad as possible without compromising the coverage that its brokers’ clients are asking for, Nelson said. The group is empowered to do that by relying on its scalability, and (crucially) being smart with the data it has available to determine the cause-effect relationship between security controls and claims activity.
“We’re also at a crucial point where cyber, and a company’s intangible assets broadly speaking, are their largest exposure, with the frequency of loss far greater than traditional tangible perils addressed elsewhere,” she said. “Yet, cyber has historically been the smallest proportion of their premium spend in their insurance programme. So as rates are climbing to address what is now a company’s largest exposure, there is an initial reluctance from clients and brokers to view cyber premiums as one of their biggest spends – and the reality is, in all likelihood, they will be.”
Given the role of cyber insurance in acting as a proactive service, having pre-emptive discussions is key to advancing the narrative around cyber risk. From a client’s perspective, Nelson said, the industry is at an inflexion point where even as businesses understand that their largest exposures lie in their intangible assets, they continue to have difficulties in accepting that this, therefore, needs to be priced to match the exposure. It’s perfectly reasonable to expect that your largest exposure is ultimately going to be one of the more costly aspects of your insurance programme, she said, and this needs to be more widely accepted.
“Our entire philosophy at CFC is that, as a policyholder, you are at less risk of a cyber event than you are uninsured,” she said. “Cyber insurance is one of the only product lines available where, from the insurer perspective, we can proactively detect, inform and prevent vulnerabilities from turning into compromises, before the client even knows to file a claim.
“When a business falls victim to a cyberattack, it can be handled extremely effectively with the client compensated financially – however it doesn’t prevent the intrusive feeling a business is left with after having a threat actor in their networks. Cyber insurance can prevent that from happening in the first place. And given that it’s in a cyber insurer’s mutual best interest to prevent claims before they happen, it should be an expectation of any cyber product that they provide a continuous monitoring service on behalf of their policyholders to ensure their policy works for clients from the very first day they bind.”
You can find out more about how CFC protects businesses against cyber risk here.
Lindsey Nelson has served the insurance sector for over 10 years now. As the cyber development leader at CFC, she leads the global cyber distribution strategy across CFC’s portfolio.
