Rentrup rails against cyber logjam
Disagreement on the definition of a “cyber event” is hampering efforts to underwrite the risk and is leaving society exposed, Konrad Rentrup, chief executive of Hannover Re Bermuda, told PCI Today.
Only a handful of policies are written at the $400 million level and obtaining that amount of capacity at cost-effective rates is daunting for any broker, he said. Capacity for anything over that figure is severely limited leaving major sectors of society at risk.
Rentrup also blasted the re/insurance industry for dragging its feet in the search for a solution.
“Cyber insurance can assist individuals, companies and societies to solve the problems resulting from cyber attacks only if a significant support and capacity of the reinsurance industry is secured. However re/insurers are yet to find consensus on the definition of a ‘cyber event’—an impediment in developing true cyber catastrophe coverage,” he said.
“At present cyber reinsurance is placed on an uncapped QS and Aggregate XOL basis with low per-risk limits which does not facilitate deploying large capacities, although there is demand for it.”
In its infancy, with an estimated market size of $2.5 billion of premium income, cyber insurance is projected to reach $7.5 billion by 2020 at a stellar growth rate. But with a penetration rate of less than 20 percent in the US and far below that outside the US, cyber insurance has a lot of room to grow.
After a few headline events over last two years some insurers have scaled back on cyber capacities, especially for large names that are thought to be a lucrative target for cyber criminals, which exacerbated the shortage of capacity.
“Virtually all insurers have, or are in the process of, introducing a cyber insurance product,” said Rentrup.
“So far demand has exceeded supply in the number of protections and limits requested. This is in part due to an observed increase in frequency and severity of cyber attacks, the changing regulatory landscape and the perception of insurance as a value addition measure to cope with the economic losses resulting from these cyber attacks.
“Yet the market struggles to devise products to cope with the increased demand.”
Data surrounding the exposure and events is scant and actuarial models are yet to be developed. Although existing literature has covered ground on cyber catastrophic scenarios, virtually none of such scenarios has materialised.
Rentrup suggests that one key metric markets can utilise is a well-defined realistic disaster scenario (RDS) that captures main cyber catastrophe scenarios. This will enable aggregation control, pricing and structuring of the catastrophe layers.
He believes that Bermuda is ideally positioned to provide a hub for the research and development of a suite of products to combat the threat of cyber attack, thanks to its prominence as a global leader in property-catastrophe.
“As an industry we have experienced such situations before the catastrophe models evolved and we did not have a standard way to represent a property catastrophe event. With the opportunity at hand with cyber it is time to revisit history and apply the learning from decades back.”
