Insurers tighten cyber cover terms, raise premiums amid cyber attacks

Singapore

THE onslaught of cyber attacks, as Covid-19 intensified digitalisation and offices embraced remote working, is taking a toll on the cyber insurance market.

According to sources, insurers are tightening capacity for cyber cover in Singapore and the rest of Asia, in line with the global trend. Companies will have to brace for significantly higher premiums - as much 50 per cent more - and tighter underwriting requirements.

Companies with inadequate risk management protocols may find their cover reduced or withdrawn altogether, particularly in terms of ransomware risk.

Incidence of ransomware has exploded in recent months. According to Aon, cyber insurers reported a 336 per cent jump in claims from the start of 2019 through to 2020. Cybersecurity Ventures expects ransomware to cost US$20 billion this year, 57 times the level in 2015. By 2031, the damage is expected to escalate to US$265 billion.

This year alone has seen a number of high-profile attacks, such as Colonial Pipeline in the United States which paid US$4 million in Bitcoin ransom. Last month AXA was hit by a targeted ransomware attack where three terabytes of data were reportedly stolen from units in Thailand, the Philippines, Hong Kong and Malaysia. Acer was also hit by ransomware where attackers demanded US$50 million, said to be the largest known ransom to date.

Ransomware is a form of malware that encrypts users' files. Attackers demand a ransom to restore access to the data. According to Coveware, the average ransom payment has risen 43 per cent to US$220,298 from the fourth quarter of 2020.

Damages that may be covered by insurance include business interruption, revenue loss, forensics and even ransomware negotiations. But increasingly insurers are said to introduce sub-limits on ransomware attacks.

According to Fitch, profits of property and casualty insurers that write cyber coverage are increasingly under pressure as underwriters report substantially higher claims losses in 2020 than in prior years. The direct loss ratio for standalone cyber rose sharply in 2020 to 73 per cent.

It added that the escalation of cyber incidents such as ransomware is likely to hinder a near-term reversal of claims cost trends, despite premium rises and tighter coverage terms.

Insurers have struggled to limit their liabilities in cyber policies. These exposures include "silent" cyber where coverage may be implicitly included in property and casualty cover. There is also "accumulation" risk, which refers to the snowball effect of a cyber attack, reflecting an interconnected world and growing use of third-party services such as cloud storage. And there is aggregation risk where a large number of claims may be simultaneously triggered by a single attack.

The latest battlefront is so-called war and terrorism exclusions, which are being litigated in the US and Europe. Insurers are pushing back by citing exclusions and refusing to pay out, should a cyber attack be found to be state-sponsored.

Ali Chaudhry, Marsh FINPRO (financial and professional liability) leader (Asia), said that based on Marsh's Global Insurance Market Index for the first quarter of 2021, Asia's cyber insurance market faces "considerable upward pressure on rates and deductibles, with a reduction in capacity and narrowing of key coverages".

"We have seen a broad range of premium increases depending on specific risk profiles, but an across-the-board average was in the 50 per cent range."

Asian pricing, he added, has historically lagged global equivalents. But this is changing; insurers have moved Asian pricing "to line up more with (higher) global rating models".

Andrew Mahony, Aon's head of cyber risk solutions (Asia) , said that there is a "clear upward trend" in cyber premiums in Asia. A well-publicised threat environment and companies' increased reliance on digital systems partly explain the hardening trend. But in Asia there is also "a perceived need to 'correct' significantly underpriced accounts", he explained.

The region, he added, may feel the pressure more acutely "because of the fairly relaxed approach that had been taken to underwriting submissions in the past".

"For the most part, capacity is not being cut so much as carefully deployed. Coverage remains broad, but some insurers are tightening language around ransomware and known vulnerabilities."

QBE Asia's Arati Varma, head of financial, professional and casualty lines, said around 40 per cent of large organisations are believed to buy cyber protection. But take-up among small and medium enterprises (SMEs) is far lower. QBE's survey of SMEs at end-2020 found that close to a quarter do not have any processes or protection against cyber risk, despite 48 per cent stating that they are fully informed of cyber threats to their business.

According to Ms Varma, premiums and deductibles have risen in Singapore and Asia; the premium rise for large corporates is 20 to 50 per cent. Some sectors such as healthcare, financial institutions and utilities have found themselves "in the crosshairs of cyber attackers", she noted, and face steeper increases. Some organisations are "buying down their limits to manage overall costs".

SMEs, on the other hand, "have seen modest adjustments in policy terms and conditions until now", she said, despite the elevated level of ransomware attacks and the risk created by remote working.

AIG in the US has added 25 detailed questions on clients' security measures as part of its tougher underwriting approach, according to a recent report in the Financial Times.

Liam Pomfret, AIG head of cyber and professional indemnity (Apac), said: "We are placing a lot more scrutiny on the controls companies have in place. If companies cannot demonstrate they have deployed adequate controls, we may reduce the amount we will cover them for, or in some cases not cover them at all... At AIG we reward organisations that have strong cyber security hygiene controls with more favourable terms and breadth of cover."

Brandon Bruce, EY Asean and Malaysia insurance sector leader, said that globally and in Singapore, the take-up of cyber cover has neither met projections nor grown in tandem with the rising cost of cyber crime.

From an insurer's perspective, an understanding of the nature of the risks to be underwritten, how to attractively price and distribute the product are big challenges. "Technical pricing is critical to ensure you are charging the right premium for the right level of risk, especially given how complex and esoteric this business can be," he said.

From the buyer's perspective, cost is a big hurdle and many seek to consider self-insurance or alternative types of cover, he added. "Because this type of risk is still generally nascent, you can also be sure that the terms and conditions applied will be restrictive to the buyer, which would make it unattractive to the buyer."

PwC Singapore insurance leader Woo Shea Leen (see amendment note) cautioned that Singapore has an "increased threat outlook" compared to other parts of Asia, as it is ahead in terms of digitalisation, which makes it more dependent on digital infrastructure and more vulnerable. "Anecdotally there are signals that the capacity to cover is decreasing as the number of attacks increase, making it challenging for organisations to get adequate cover, especially on their initial layers of losses. There are also concerns that these entities are not doing enough to safeguard their assets and prevent such incidents."

Amendment note: A previous version of this article misattributed a quote by PwC Singapore insurance leader Woo Shea Leen. The article has been revised to reflect the correct attribution.