Stephen Catlin and regulator warn insurers over cyber risk exposure

Stephen Catlin, the founder of Catlin, and the UK’s Prudential Regulation Authority (PRA) warned insurers over their cyber risk exposures.

“Cyber is the biggest systemic risk that the insurance industry has ever faced in my lifetime,” the insurance veteran said during the 2017 MGAA conference in London on July 4.

“I can’t think of any other risk that can affect the entire world in a nanosecond,” Catlin explained. “There will never be enough insurance capital to take that risk,” he continued.

Cyber is seen as one of few opportunities to grow in and otherwise subdued re/insurance sector. Annual gross written premiums in cyber are set to increase from around $2.5 billion in 2015 to reach $7.5 billion by 2020, according to estimates.

But such growth may carry unforeseeable risks. Hackers may be able to 'tip over' the internet in less than three years, according to experts, Catlin noted. If the internet was to tip over for 24 hours this would trigger a global economic crisis, he said. If it extended to a week, that would be a cataclysmic crisis of dimensions we can’t possibly imagine, he added.

“Coverage policy on cyber is absolute nonsense,” Catlin said.

Following a cross-industry review, the PRA issued a new supervisory statement on cyber insurance underwriting risk on July 5 focusing on the exposure of insurers to the accumulation of cyber risk through the insurance policies they write for their clients.

“The PRA expects insurers to get a better handle on their cyber risk management and should be seen as a clear sign that action needs to be taken by insurers and reinsurers to fully understand their cyber exposure,” said Marta Abramska, associate director in PwC’s cyber insurance practice.

“The difficulty of dealing with cyber threats is no longer an acceptable excuse for inaction and the regulator has today set out the steps insurers need to take to provide security and stability.”

A number of global ransomware attacks dubbed ‘WannaCry’ or Petya have hit companies all over the world, shutting down computers and operating systems. The costs for insurers may have been limited due to the low spread of cyber insurance.

“Although we have not yet seen large insurance losses, recent near misses such as Cloud Hopper highlight the large systemic potential of malware in a connected world and should form the basis of robust portfolio stress tests that the PRA has asked firms to complete,” Abramska said.

"One of the key issues the PRA wants insurers to manage is that, even if they do not underwrite specific cyber insurance policies, they may be at risk of having to pay out for cyber damage falling under existing policies such as General Liability or Property. The regulator expects insurers to fully understand their exposure. Non-executive directors (NEDs) in particular are expected to be held accountable for any failures to properly challenge management as they deal with this risk.”

In a recent pulse survey PwC carried out among 14 re/insurance companies in the UK and the London Market, only 14 percent of respondents said they have the data readily available to be able to assess their exposure to ‘non-affirmative cyber’. The other 86 percent rely on manual or proxy methods. Over 70 percent of respondents believe that the losses from a cyber event could be comparable to the losses from extreme natural catastrophes.

"A lot of work is still required by insurers in order to measure and mitigate this risk,” Abramska noted.

Join us at  Intelligent InsurTECH Europe 2017 - Use code "Save20" to save 20% on selected tickets until July 15th

Today’s stories

Munich Re appoints former Allianz chair to supervisory board

Swiss Re names new market underwriting head succeeding Fuchs

Arch completes AIG's UGC Asia business takeover

Swinton Group partners with UK MGA Lorega

Elite Insurance goes into runoff

Did you enjoy reading this story?  Sign up to our free daily newsletters and get stories like this sent straight to your inbox.