Lockton Re: Hypothetical Cyber Event Offers Carriers an Opportunity to Review Risks

A simulated cyber catastrophe highlights the benefits and problems cyber insurance carriers will encounter as a result, according to a report released by Lockton Re.

The report, “A Kaleidoscope of Possibilities: Preparing for Ivan Wiper,” focuses on the consequences of a potential cyber catastrophe by reviewing each part of the value chain across the insurance industry, the reinsurer said.

“We wanted to explore the potential aftermath of a major cyber catastrophe, as this is an area which has been overlooked in discussions on systemic risk,” said Oliver Brew, co-author of the report, and London Cyber Practice leader, Lockton Re. “We selected a hypothetical self-propagating destructive malware (named Ivan Wiper) and assumed a midpoint view of its impact globally. We spoke to experts across our industry to consider both understanding and impact. The views of different experts in the value chain were key to this paper.”

Reviewing how the insurance industry responded to past events offers insight as to how it will respond in the future.

“In the past large incidents like Hurricane Andrew, the Tohoku Earthquake, and the Terrorist attacks on the World Trade Center created horrendous loss of life and property, and from an insurance perspective they often reshape the industry creating movement in risk appetite and acceleration in specialist capacity and expertise,” the report’s authors wrote.

As a result of Hurricane Andrew, for example, there were multiple insurance carrier insolvencies, as the risk and damage was underestimated resulting in legislators having to step in to create new regulations. The report authors noted that reinsurance became more widely used after this storm.

In the Ivan Wiper scenario, the losses total $28.4 billion, placing it just outside of the top 10 losses the industry has ever experienced, according to the report.

In fact, the P&C market will come out relatively unscathed unlike the cyber insurance market, the authors said.

The cyber insurance aggregate loss ratio will be close to 200 percent, while reinsurance will be substantially eroded. The timing of the event will be an important factor.

“The interaction between the timing, speed and scale of the rate increase hitting the direct market will flow through the reinsurance market in different ways,” said the report authors. “This will depend on inception date,treaty basis, fixed limits versus limits variable on premium, etc. Those reinsurers which plan for a catastrophe such as Ivan will likely fare better.”

Not surprisingly, those insurers and reinsurers who have a history of pricing risk accurately, portfolio diversity and prompt claims handling will handle an extreme scenario well.

“The very purpose of our industry is to understand and quantify risk. The management and mitigation of risk has built our industry over centuries, building societal resilience with it,” said Matthew Silley, co-author of the report, and Cyber Broker, Lockton Re. “Cyber catastrophe risk is a complex but fundamental pillar of the broader market. The insurance industry has built its reputation supporting recovery after major events, learning, and adapting. Notwithstanding that a major cyber catastrophe has yet to materialize, the cyber insurance industry has been proactive in addressing the potential for significant systemic risks.”

The likely outcome will be higher pricing, increased penetration rates and portfolio management improvements.

“For the (re)insurance industry itself, our view is that the most likely effect of Ivan Wiper will be the acceleration of a cyber catastrophe market with new product innovation, and a growing consensus around common cyber war and critical infrastructure exclusions,” Brew added.

Some key takeaways from the simulated event:

• There have been, and will be bigger natural and man-made disasters, in all but the most extreme scenarios.
• There are benefits from the market working collaboratively on these sorts of incidents.
• There will be potential major bottlenecks in claims handling and processing.
• Some (re)insurers will withdraw from the cyber insurance market, though there is strong appetite by those experienced (re)insurers to recapitalize and take advantage of dramatically improved rating conditions.
• A catalyst for innovation and product development.

“It’s important to remember that these events are more challenging for those companies who either cannot afford, or choose not to buy insurance, so the impact could be significant,” Silley added. “They will struggle to access specialist incident response services unless they have in-house or retained access. The goal of the paper is to raise questions and challenges, rather than fear or anxiety. By considering specific issues for each stakeholder, the conversation can progress.”