Cyber and terror: Key threats for re/insurers in 2019 - Banana Skins report

Whether it’s a data-rich legacy system that won’t talk to your artificial intelligence (AI), or sophisticated cyber criminals targeting that same highly valuable data, the risks associated with the take-up of modern technology and cyber are “the biggest upfront risks” re/insurers face in the next two to three years.

That is the finding of the 2019 Insurance Banana Skins survey published in June by the Centre for the Study of Financial Innovation (CSFI) and PwC. This is only the second time risks surrounding technology and cyber have been flagged as the top two concerns since the survey began in 2007.

“This shouldn’t be a surprise,” says Andrew Hilton, CSFI director, in his preface to the report.

“After all, it is well known that many insurers are lumbered with legacy systems that need updating—and that integrating them is time-consuming, fiendishly complicated and, inevitably, very expensive.

“Equally, we are all aware of the risks around cyber: from simple hacking, from ransomware, from Trojans, even from malevolent state actors. We are less aware of ‘silent’ cyber exposure—but it is a real risk that is starting to take up much more C-suite time.”

A winding road
The urgent need for modernisation is clear to many. The big tech players such as Google and Amazon are not interested in competing in the re/insurance sector at the moment, but that doesn’t mean they couldn’t, particularly if industry advances continue to lag.

The road to modernisation is not easy, however. Survey respondents point out that legacy systems and business models, as well as potentially decades-old IT infrastructure, present barriers to meeting the changing demands of the industry. This inability to upgrade technology fast enough, or lengthy project delivery times that mean tech is almost redundant by the time it is in place, is the top ‘banana skin’ or risk that could wrong-foot the re/insurance industry.

Concerns about technology are a pervasive theme throughout the report, underpinning other high-ranking risks including cyber (ranked second), change management (number three), and competition (number seven). By sector, tech was ranked first for the life and non-life areas of the industry; and by geography, in Europe, Asia-Pacific and North America.

As the CSFI acknowledges, modernisation requires capital and skills that are currently in short supply. The task is made more difficult as forecasting future needs is a far-from-certain art.

The treasurer of an insurance company in the US told the survey: “The insurance industry as a whole is woefully behind other financial services firms in implementing technology.”

Many respondents say that throwing money at the problem is not the solution. Installing advanced tech can open up opportunities, but it is also “a significant strategic risk if you bet on the wrong horse”.

The chief executive of a composite insurer in Belgium said: “The key is to make the right choices, ie, to which technologies do you give priority? When it is for process improvement, the choices appear to be quite clear. When it is for a commercial approach to end customers, the certainty to invest in/launch successful projects is much lower.”

Choosing the wrong tech could mean businesses miss vital opportunities to ensure they keep up with the competition from inside and outside the traditional insurance industry.

Chris Powell, managing director and chief executive at Integrity Life, Australia, told the report: “The industry is highly likely to select large ‘industrial’ systems to replace current legacy systems. This could well lead to today’s legacy systems being replaced by tomorrow’s legacy system. The industry should look to new ways of using proven technology to provide modern, flexible, adaptable systems.”

Cyber concerns
Cyber crime is the second biggest risk for re/insurers overall, according to the survey. With miscreants highly skilled in hacking and other digital burglary techniques, and shady ‘state actors’ funded by deep dark pockets, it is not surprising that cyber crime is identified in the survey as the top concern for the broking, composite, and reinsurance sectors.

The CSFI says the findings show cyber-related concerns “have intensified” from previous survey results. Many respondents commented on the industry’s exposure to risk as a result of underwriting cyber insurance.

A president of a general insurance company in Indonesia told the survey: “Insurers don’t know how bad this can get—limited cover is the only option as disruption by digital crime is still not clearly understood.”

A Hong Kong-based respondent said: “Lots of insurers are trying to write cyber policies, but the potential impact of cyber insurance claims is still very much unknown (even if cyber itself isn’t new, the scale of potential impact is unimaginable).”

A respondent based in the UK adds: “Cyber coverage/exclusion contracts are yet to be really tested.”

Overall, the tone of the survey responses is “the most negative” the CSFI has seen since it began the survey series in 2007. “This is largely due to the scale of the challenges facing the industry through technological and structural change, and concern about the industry’s ability to manage them successfully,” it explains.

“Pessimism is due largely to a rise in operating risks, notably advances in technology which challenge the industry’s traditional structures.”

The risk respondents ranked as their third highest concern—change management—is closely linked to technology as it “exposes a high level of concern, even doubt, about the industry’s ability to address the formidable agenda of digitisation, new competition, consolidation and cost reduction which confronts it”.

Talent in technology
The report’s authors say that technology risk is also responsible for the high position occupied by human talent—number eight. “There is concern that the industry may fail to attract sufficiently able people to enable it to address change successfully,” they note.

Technology and cyber crime risks ranked in the top two for most areas of the industry, although on the non-life side, concerns focused more specifically how tech is driving “the entry of new forms of competition and distribution”. The report found that cyber crime featured in a double capacity “as a threat to industry security and as an underwriting risk”.

For reinsurance respondents, cyber risk came top as a security issue and an underwriting risk. But climate change came second, “marking a dramatic new entry to the ranking” and pushing technology concerns into third position.

Views on how well prepared re/insurers were for these risks reveal the struggle many have in getting buy-in for digitisation or the straight out apathy they encounter.

One non-life re/insurance respondent said: “Insurers in general have benefited from living in a reasonably profitable and stable sector, which has demotivated change, innovation and transformation. The players not willing to transform and not fully aware of the challenges and opportunities arising will be at risk of disappearing.”

Another non-life sector response said: “Business and underwriting risks attract a lot of attention and resources. Legacy systems or other drains on time and expense, comparatively less so.”

A further non-life sector professional said: “The industry has the tools and the money, but adopting new practices in an industry with aging leaders will be hard.”

The need for more urgent action is plain. As CSFI’s Hilton says, the emphasis on the risks of technology and cyber from 927 survey responses across 53 territories “ought to be a wake-up call”.