State-backed cyber pool must be formed: Catlin
The risk transfer industry and governments should partner to form a state-backed risk pool designed to cover worst-case scenario cyber attacks, Stephen Catlin, the executive deputy chairman of XL Catlin, told Monte Carlo Today.
The former chief executive of Catlin said that a devastating and/or prolonged cyber attack is the most serious threat facing society and one of the few that could have truly global implications.
Yet governments are ill-prepared for such a scenario and the industry is very limited in its ability to help. Only a partnership and the formation of some kind of risk pool could help mitigate the consequences of such a scenario.
“Terrorism is a relatively local threat,” Catlin said. “So are earthquakes and hurricanes. But a cyber attack has the potential to affect the entire world in a nanosecond. As things stand, governments are ultimately exposed to anything happening on this front, which means we are all personally exposed.
“We all live through the internet these days. If someone was able to knock the entire internet down, the whole economy would fall apart very quickly. It would be very painful for society.
“I believe a mechanism could be put in place to move a chunk of this risk into the private sector. We manage to do it for terrorism risk, through mechanisms such as the Terrorism Risk Insurance Act (TRIA) in the US and Pool Re in the UK, and I believe we should do the same for cyber.
“The industry could take a meaningful amount of risk—enough that it would be painful if a big event occurred but not so big that it would damage the industry.”
He conceded that such ideas take time to come to fruition and it often takes a disaster to elicit a response.
“My only hope is that when that happens, the first event is big enough to prompt action but not actually cataclysmic,” he said. “I just believe that governments and industry should start working on a solution now.”
Looking backwards
Catlin said that one of the great failings of the re/insurance industry is that it tends to view risk through a rear-view mirror.
“Risks are changing so rapidly now, that is very unhelpful,” he said. “We need to start looking forward at how things can change in the future.”
This is also the flaw underpinning its other great failing, Catlin said: the industry’s reluctance to embrace technology to make processes faster and more efficient.
He recalled being on the Lloyd’s Franchise Board around a decade ago when Kinnect was rolled out, an electronic risk exchange which, it was claimed, would revolutionise the market.
Well over £50 million was spent on the project before it was unceremoniously scrapped due to a lack of adoption and the view that it was not fit for purpose.
More recently, the London Market Group is exploring ways of modernising the market but, Catlin said, no matter what the resources thrown at the project or the brains behind it, the market will act and come together only when it is forced to—usually by adversity.
“The trouble is, unless the bridge is burning it is very difficult to implement any change,” he said. “In adversity, the market comes together, but the rest of the time, people are loath to change,” he said.
The other problem with previous initiatives was that they were not driven by senior enough people. “You then get people working on it who do not understand the bigger picture and lack the power to drive it forward,” he said.
“Something needs to change. So many processes in the industry are still reliant on manual data entry and are duplicated many times. The only answer is collaboration and an acceptance that the industry must embrace this or risk being completely left behind.”
