How Cyber Market Changes Will Impact Claims

Changes in the cyber insurance market are expected to bring challenges to claims departments, according to Tom Johansmeyer, assistant vice president at PCS, a division of Verisk Insurance Solutions.

In an interview with Claims Journal, he explained that as the value of cyber losses stabilizes, he expects to see less vertical growth. Instead, there will be more horizontal growth as previously uninsured businesses seek cyber coverage. This, he said, will create a learning opportunity for claims departments.

Cyber has changed quite a bit in the past 5-10 years, said Johansmeyer. Most notably, the value of catastrophic claims has risen leading to a steady increase in coverage size.

He explained that a major breach in 2009 impacted shareholder value negatively for six months, even while there was minimal impact on the insurance industry. Moving to 2014, there were $90 and 100 million losses, whereas losses today range between $100 to $300 million. As a result, some coverage towers have risen to $500-$600 million in coverage.

“So, what we’ve seen over the past 10 years or longer is a fairly steady increase in coverage sizes for cyber risk losses,” said Johansmeyer.

It’s unlikely that towers will increase to $1 billion, rather, horizontal growth is expected in the future as businesses that were previously uninsured for cyber purchase coverage.

As more companies gain coverage, he anticipates claims departments will see more cyber losses.

“The claim handling dynamic will be a little bit different, because we still could see the Equifax/Merck type losses where the insured loss is so much smaller than the economic loss that it could, at least in the near term, keep the claim handling process a little simpler than it would be if there were coverage towers in place to match the economic damage being caused,” Johansmeyer said.

The difficulty for insurers in handling these types of claims is determining if it really is a cyber loss and whether it is covered, he said. That’s because some cyber losses are gaining coverage through other lines of business.

“You’ve got a lot of major losses that are being call cyber but are being explored under other coverage areas, because either cyber coverage wasn’t in place or affirmative cyber cover wasn’t sufficient to cover the economic loss,” said Johansmeyer.

Calling it the “silent cyber issue”, he offered the example of a system outage, like the one Southwest Airlines experienced in 2016, which could be covered in some affirmative cyber policies. In addition, he said a cyber style loss like Delta Airline’s, which was covered under its property policy, could be covered under a non-cyber tower.

“Or you could have a cyber type loss that seems to resist coverage in any class of business and you then have an effort by the insured to make the coverage that’s in place work where there may be resistance from the insurer,” said Johansmeyer.

Additional challenges surround the nature of the loss and whether it would qualify as a catastrophe, as well as whether flexible language in other policies might include coverage for a cyber-related loss.

The lack of loss history is another major challenge when it comes to handing cyber claims, he said.

“In any other class of business, property risk or liability, you’ve got a lot you can look back on,” he said. “These coverages have been place longer, events have been more frequent, …there’s a lot more history, there’s a richer past to draw on and there’s both more individual experience and institutional knowledge.”

As the cyber market and threats grows, it will present a learning opportunity for claims to understand these types of claims better, he said.

“You’ve got an opportunity to learn more about how cyber attacks work, what follows a cyber attack in terms of the loss event, and then finally what issues could arise had more coverage been in place,” said Johansmeyer.

Because the cyber market is still in its formative years, the mistakes made now won’t be as costly as they would be in the future.

“So, sure there are going to be mistakes made,” said Johansmeyer. “It happens during the formative years of any market. But, the upside, at least, is we can make mistakes with $500 million towers instead of $500 billion towers.”