Cyber security: a top concern


Cyber security: a top concern

Cyber risk has come out of nowhere to be the third most worrying risk for the Bermudian re/insurance sector, as reported in the biennial Insurance Banana Skins survey, as Arthur Wightman of PwC Bermuda explains to Bermuda:Re+ILS.

The 2015 biennial Insurance Banana Skins survey, published by the Centre for the Study of Financial Innovation (CSFI) in association with PwC, identified the risks—the banana skins—facing the global insurance industry in the first half of 2015, as seen by a sample of 806 practitioners and close observers from 54 countries.

“We’re pleased to support the CSFI’s Insurance Banana Skins initiative, which provides valuable insights into the risk concerns at the top of the boardroom agenda in Bermuda and globally,” says Arthur Wightman, PwC Bermuda leader and insurance leader.

Regulation emerged as the overall top risk for participants for the third successive time, underlining the deep impact regulatory change is having, but in Bermuda, cyber risk was a top three concern bested only by market conditions, followed by regulation.

Significantly, the overall tone of the responses this year is more negative than the previous survey in 2013, as measured by the Insurance Banana Skins Index (the ‘anxiety index’), despite the resumption of global growth.

“This pessimism is due primarily to pressures from the economic and public environments. Concern is driven by the quantity of regulatory reform at all levels, in particular the EU’s Solvency II Directive. The fear is that these initiatives are loading the industry with costs, and distracting management from the task of running profitable businesses, as well as heightening compliance risk,” Wightman says.

The reinsurance sector’s main concern centres on the soft conditions created by excess capacity and ‘new’ types of capital—for example, hedge funds—and what many see as onerous regulation of the market.

But the lack of a robust and well-defined market for cyber risk is another top concern—especially so in Bermuda where it came near the top of the list of concerns. 

“Cyber risk is now ranked number three in Bermuda and it is the top concern in the US and UK. As an industry that handles large amounts of other people’s money and personal data, insurers are prime targets,” Wightman says.

“Cyber attacks and data breaches are seen as especially urgent by the industry from the standpoint of a threat, but also as an opportunity. With material losses now in the billions, the demand for insurance to cover cyber risk has risen considerably. Notwithstanding, cyber is also an underwriting risk which has yet to be fully scoped.”

The chief concern for respondents is the security of the ever-growing volumes of data that insurers hold in cloud-based storage systems. For many, major breaches are inevitable—the question is how much damage they will cause.

The industry is vulnerable to the growing sophistication of cyber criminals and the constantly changing nature of the threat. The task is made more difficult by the growing number of attacks, only a fraction of which need to get through to cause serious disruption. One respondent, the chief financial officer of a non-life company in Australia, said cyber risk was “a major threat”. ”We repel more than 20 serious attacks every day. Half of these we suspect are state-sponsored attacks.”

The impact of a successful attack could be very significant—from the costs of additional security to service disruptions, the loss of intellectual property or sensitive information and compensation claims or fines. The biggest risk of all could be a loss of trust from customers.

While this Banana Skin was specifically the insurance industry being the target of cyber attack, a broader point was about the underwriting risk. One actuary in Bermuda pointed out that existing insurance policies which do not specifically exclude (or do not mention) cyber attacks may be vulnerable to hefty claims if a major incident occurs.

Soft markets

“A new Banana Skin was introduced in this year’s survey, to measure concerns about prolonged soft markets and their impact on profitability. Specifically, we asked whether the insurance cycle could result in poor market conditions for an extended period of time. The mid-table ranking of this risk suggests it is on respondents’ minds, notably in the reinsurance sector where it topped the list,” says Wightman.

Existing insurance policies which do not specifically exclude (or do not mention) cyber attacks may be vulnerable to hefty claims if a major incident occurs.

Concerns centre principally on excess capacity and the pressure this is putting on insurers’ margins. The chief financial officer of a non-life insurance company in New Zealand said: “New competitors and a surplus of capital will support a soft market for some time. Therefore traditional insurers will need to continually look at operational efficiencies.”

The capacity being created by new sources of capital such as hedge funds, which have focused increasingly on insurance-linked securities (ILS), is providing additional liquidity to the market.

Wightman adds: “The long-term prospects for insurers and reinsurers are positive as people around the world live longer and have more wealth to protect. Yet they also face the disruptive impact of new technology, changing customer expectations, more exacting regulation and enduring economic uncertainty.

“Insurers’ ability to identify and manage emerging as well as familiar risks will be one of the key differentiators for success in this volatile competitive environment.” 

The survey is the latest in the CSFI’s long-running Banana Skins series on financial risk produced in association with PwC. It can be found here.

Arthur Wightman is PwC Bermuda leader and insurance leader. He can be contacted at 

Arthur Wightman, PwC Bermuda, Bermuda

Bermuda Re