Cyber risk modelling alone will not narrow the protection gap for peak cyber perils

Published Date: 11/15/2023
Source: By Patrick Bracher (ZA), Norton Rose Fulbright

---

Every insurer needs to read the research summary ‘Cyber Risk Accumulation: Fully tackling the insurability challenge’ issued by The Geneva Association in November 2023. Even though prudent insurance companies underwrite cyber risk with tightly-defined contract wordings, limited risk-absorbing capacity and requirements for risk management by the insured, this is not enough having regard to the overall possible cost arising from a major global cyber incident or campaign. Guesstimates of global losses up to USD8 trillion have been made.

Cyber perils in the form of malicious or accidental acts that compromise the confidentiality, availability or integrity of data or IT services simultaneously across different geographies create massive potential cyber loss accumulation. Formal models to support the assessment of cyber risks and to help to steer exposure management “remain immature and their results can be volatile and inconsistent”. The extreme cyber scenarios suggest caution in placing too much faith in risk metrics from any one or even multiple models. Better risk modelling, while necessary, will likely not be sufficient to attract significant additional risk-absorbing capital. The report suggests how to go beyond better models including cooperation with key stakeholders such as government, security agencies and major technology companies, fostering mechanisms to pool cyber exposures among risk carriers, creating enhanced legal liability for IT firms, and getting government financing. None of these is a ready solution in South Africa and increased premiums alone is not going to achieve what is needed for prudent underwriting. With rising geopolitical political tensions over recent years there is a material worsening of the cyber threat landscape and heightened fears about a serious cyber incident. Even if a truly catastrophic cyber incident does not occur in South Africa, supply chains and many other causes of loss will result. When meeting the actuarial challenges that cyber risks pose, a close reading of the report is essential.

Cyber Risk Accumulation: Fully tackling the insurability challenge | The Geneva Association