The volume of supply chain attacks grew by five times between 2021 and 2023, with businesses exceeding $50mn in revenue bearing much of the brunt, according to findings from the Cyber Roundup Report 2024 from Cowbell.
Compulsory cyber insurance and tax relief on cyber investment have been identified as two measures that may incentivise greater cyber resilience among UK businesses, with new research by Howden showing that more than half of UK firms have faced at least one cyber attack in the past five years.
Latest Articles
Welcome to this month's edition of Cyber Risk Insurer, your monthly digest covering supply dynamics, pricing and loss trends, emerging risk threats, market penetration, potential public-private initiatives for cyber cat and a host of other areas.
More Articles
The Insurer TV
Coalition’s Shawn Ram has said that being cash flow positive since July 2022 means the insurtech feels no pressure to tee up its next liquidity event, with the $5bn valuation it achieved coming after funding conditions had already “tanked” and amid higher scrutiny.
Cloud providers like Google are exposed to so many types of security threats that they are capable of staving off more cyber attacks than many on-premise systems, according to Monica Shokrai, head of business risk and insurance at Google Cloud.
Ahead of today’s hotly anticipated launch of Cyber Risk Insurer, Janet Babin of The Insurer TV caught up with the editor of the new title and longstanding journalist at The Insurer, Michael Loney, on what to expect and why it’s never been more important to have a dedicated news source covering the rapidly growing cyber insurance market.
Cowbell’s chief claims officer said that threat actors are becoming more sophisticated in their attacks, now targeting the “quality” of data rather than just volume, and that social engineering threats have evolved beyond just business email compromise.
CyberCube’s CEO Pascal Millaire said that his firm’s accurate predictions of industry loss ratios in recent years have been “proof points” in the maturity and validity of cyber modelling and said cyber models have gone from being “interesting” to being “useful”.
Cyber incident response firm MOXFIVE’s CEO said the resurgence of threat activity has created whiplash within the incident response community, and also discussed the maturation of the industry and the importance of providing clients with a feeling of “control” after a breach.
The president of SME-focused cyber insurtech Elpha Secure said the spike in cyber ILS transactions last year reflected demand for more capacity in the cyber segment, and also laid his firm’s focus on improving insureds’ cyber hygiene.
Johnson Kendall & Johnson’s cyber practice leader has said insureds need a greater awareness of the “duty of care” obligations associated with business email compromise breach events, warning this could lead to claims being challenged down the road.
While most traditional insurance lines typically see relatively limited interaction between insurers and policyholders, the emerging cyber market redefines the relationship between the two parties.
Ransomware “really had a resurgence” in 2023 over the prior year, according to Lauren Winchester, SVP, Risk Advisory at Corvus, who told
Small to medium-sized businesses remain “a target-rich environment” for threat actors, according to At-Bay’s head of digital forensic and incident response (DFIR) Larry Crocker, who also touted the importance of managed detection and response (MDR) services.
A key metric for insurers to consider when using AI is the impact it has on the business from a risk perspective, according to Arch Insurance Group’s vice president – cyber risk product leader Shiraz Saeed.
Corvus’ chief information security officer Jason Rebholz has warned that premiums in the cyber market are failing to keep pace with the current threat landscape.
Beazley is pushing harder for rate increases in cyber than some of its competitors as the carrier looks to ensure the risks covered are properly priced in response to the continued uptick in ransomware attacks, CEO Adrian Cox has said.
The organisers behind NetDiligence have wanted to create a specific programme for the Latin American market for some time, and seized the opportunity at the recent Cyber Risk Summit, which took place last week in Miami.
As the cyber insurance market continues its growth trajectory, one of the major uncertainties is around third-party losses and potential tail risk.
Surefire Cyber’s CEO said that the wave of threat activity in recent years has provided “a helpful indicator” of how the industry might respond to a catastrophic cyber event, which he said remains a “difficult problem” with more answers needed.
K2 Cyber’s Meghan Hannes said that the newly-launched venture plans to combine the power of incumbency brought about by K2’s existing industry relationships and product set with the opportunity to take a “blank slate” approach to cyber.
Tokio Marine HCC’s Jacob Ingerslev said that the cyber market is going through a natural swing between hard and soft market conditions and called the lull in threat activity in 2022 an “anomaly”, predicting that conditions will become firmer.
An erosion of ethics and increased carelessness among threat actors are making breach response both harder and easier, according to the co-founders of cyber incident response firm Fenix24, as they highlighted the life and death stakes of breach incidents.
Interviews & Profile
Analysis & Comment
Cyber Risk Insurer revealed at the start of October that Euclid had hired Munich Re’s US cyber practice leader Annamaria Landaverde to launch a new cyber MGU.
Cyber market observers believe that the CrowdStrike outage could lead carriers to “recalibrate their pricing”, with some even believing the incident could present a “Goldilocks scenario” where pricing and demand rise without large losses.
The CrowdStrike outage has dominated the cyber insurance market’s attention since around 8.5 million PCs went offline due to a faulty update.
Insured losses from the CrowdStrike outage could top $1bn but carriers appear confident they will be manageable.
Cyber insurance market players have been reacting to the CrowdStrike outage, assessing the potential losses from the incident and warning about threat actors trying to take advantage through social engineering attacks.
Travelers and AIG saw the most significant share price falls on Friday in the wake of the major Microsoft outage, which impacted an estimated 8.5 million Windows devices.
Despite being a top target for breaches, healthcare companies are overconfident in their cybersecurity capabilities, with shortcomings highlighted in different ways by Meta Pixel exposures and the Change Healthcare attack.
AI could impact multiple insurance policies, while for cyber risks it will serve as an amplifier of exposures.
In the past year, the calls from the (re)insurance industry for government backstops have grown louder.
Ajit Jain attracted attention in early May when he commented on the cyber market at Berkshire Hathaway’s annual general meeting.
The Change Healthcare fallout has continued with reports of a second ransom demand, while market observers have suggested the cyber attack shows the increased exposure to “mini-aggregated events” and may help exert upwards pressure on pricing.
Following the emergence early last year of a number of new capital markets innovations, along with a quartet of 144A cyber catastrophe bonds in the fourth quarter, there has been much excited talk about the potential for insurance-linked securities to transform the market.
Cyber could change the insurance market profoundly. But first it needs to overcome its own growth constraints.
In assessing the role that insurance plays – and could play – in mitigating global risks, few metrics hold as much promise as the protection gap. Unfortunately, discussion of the topic has been dogged by competing definitions and widely varying estimates of the gap’s size and importance.
The Change Healthcare cyber attack has highlighted the potential for systemic loss, with some carriers likely to reassess their appetite for healthcare risks.
Dialogue is increasingly focusing on how the market will be impacted by AI.
Beazley is expecting strong cyber exposure growth in Europe during 2024 as it capitalises on a rapidly expanding market.
Cyber reinsurance buyers grew more confident in reducing quota share cessions at 1.1, according to brokers, while a flurry of ILS deals has raised hopes about capital markets’ capacity for catastrophe events.
The consensus in the cyber market seems to be that pricing will soon trend back upwards in response to ransomware activity increasing, despite new entrants fighting for market share and established players ramping up their appetite.
Cyber Risk Insurer launches its first edition at a pivotal time for the market.
Viewpoint
People Moves
Toronto-based Markel Canada has appointed Ed Rawe as assistant vice president of cyber and put forth a plan to build out its cyber insurance offering.
RT Specialty has hired long-time ARC Excess & Surplus executive and national cyber practice leader Chas Bellingrath as executive vice president.
INSUREtrust, a cyber insurance and risk management specialty broker within wholesaler CRC Group, has added Bradley Davis as executive vice president.
Arthur J Gallager has hired CAC Specialty’s Stephanie Snyder Frenier as senior vice president of its cyber liability practice and national director – Cyber Advantage.
Cyber insurer Coalition has appointed Matt Foster to the newly created role of head of London markets.
Beazley Security has appointed Mandeep Gosal as vice president of global professional services to oversee the scaling of management systems.
Specialist cyber insurer CFC has expanded its corporate cyber proposition with the launch of a team dedicated to serving brokers across Europe, led by new hire Ilaria Silvato.
The recent run of departures from cyber insurtech Cowbell has continued, with a quartet of executives resigning in recent weeks, including Western regional VP sales and distribution leader Michael Bibeau,
Cowbell’s chief marketing officer Andrea Collins has resigned from her role after a year and a half with the company to take up another post elsewhere, the latest significant senior departure from the insurtech,
Arch Capital Group has parted ways with its vice president and cyber product leader Shiraz Saeed, a well-known cyber underwriting veteran and regular speaker at industry events,
Canopius Group has parted ways with its US head of cyber and tech E&O Jenny Soubra, Cyber Risk Insurer can reveal.
Former Kennedys partner and well-known cyber insurance lawyer Judy Selby has launched Selby Strategies to offer performance coaching.
Tokio Marine Kiln (TMK) has confirmed the appointment of Thomas McShane as head of technology and media E&O.
Kroll has appointed former Marsh executive Katherine Keefe as managing director and global cyber insurance industry lead for Kroll’s cyber insurance capabilities worldwide,
Resilience has appointed former CrowdStrike executive Matthew Polly as chief revenue officer.
Cybersecurity and investigations consultancy S-RM has hired Kelly McManus as global business development lead, insurance and legal.
Markel has appointed AIG’s Jack Eastwood as a senior underwriter in its cyber and technology team.
Berkshire Hathaway Specialty Insurance (BHSI) has begun offering professional indemnity (PI) and cyber insurance lines in the DACH region, led by new recruit Thomas Pache.
Cyber insurer Coalition has appointed Tine Simonsen as its head of insurance for continental Europe.
Cyber insurtech Cowbell Insurance has hired Denise Pagliarulo as senior vice president and head of finance, as it also promoted Eric Biderman to general counsel.
