The poll was limited in that it required the participants to choose from 5 names, and did not allow an answer of ‘none of the above.’  Happily, some of the comments included their own suggestion.

Summarizing the poll results:

• Information Security Insurance – 63 votes (52%)
• Network Security Insurance – 23 votes (19%)
• Privacy Insurance – 16 votes (13%)
• Data Breach Insurance – 14 (11%)
• Network Breach Insurance – 6 votes (5%)

There were several suggestions offered up; some of the more creative included:

• Complete Data Breach insurance (which tried to get at a description of all kinds of data, not just electronic, which is an important distinction; won’t fly with the insurance industry, but I like the attitude)
• Information (or Data) Wellness insurance (doing healthy things to better manage exposures)
• Information insurance (to simplify the name, similar to life insurance, auto insurance, fire insurance, etc.)

And there were some great comments, such as:

• The term Cyber focuses insureds too much on technology risk, and may encourage investments in technology solutions while ignoring risks that arise from non-tech risk
• And from one commentator, although he didn’t originally like the term ‘cyber’, he has warmed to it, because:

- It means nothing (which means we can apply the definition we want to it)
- It is catchy (true)
- Some people actually know what it generally means

What does all of this say about the product term Cyber Insurance?

I took away the following:

• There’s a lot of unease about the accuracy of the product term Cyber, which seems to emanate from the idea that this line of insurance (should) cover a lot more than cyber-related risks
• Suggestions seem to focus on Information instead of Cyber.  I like that idea, since (as noted) cyber-based data is only one source of claims.  Claims can result from loss of data that occurs not only through network breaches but also through other  channels, such as lost or stolen laptops, thumb drives, disks, tapes, and paper records.  I believe that Information includes cyber but is not restricted to cyber, so is a more accurate term.
• But, before we go about changing names (not that I have that kind of influence), cyber has been the term for some time now, and many users know what it means.  We might change it to a more current (accurate?) term, but will it really be understood any better?

I promised a free copy of The Betterley Report Cyber Insurance Market Survey 2011 and our Middle Market Purchasing Opinions on Cyber Insurance Study to the best suggestion.  Although there were many good ones I thought Erich Bublitz of ThinkRisk showed great insight when he commented:

“It is difficult naming the coverage in part because the coverage varies so much from market to market and what is a good description for one policy is not a good description for another policy. However, keeping the term Cyber is doing a disservice to the industry and to the insureds. When people hear cyber, they assume IT which often makes the IT leader assume this coverage is being bought to cover IT and they then want to make the case they could better spend the money on a firewall or IDS. Additionally, we as an industry want, and the data security industry want, clients to start thinking about enterprise risk management, rather than IT risk management. The term cyber is not helping make the transition to ERM.”

I’d like to thank the 122 participants in the poll and the many others that read the comments, even if they didn’t offer any themselves.

• Rate adequacy and expense control continues to be the story, with carriers finally convinced of the need to obtain higher rates.  (Note: I could probably have said that better; carriers have been convinced for years – now they are executing, and the intermediaries and consultants are willing to accept it).
• 34 carrier products included – we added Zurich after some years away (Zurich/Steadfast was in our original survey of 5 carriers way back in 1993) and Arch.
• Carriers removed from the Survey this year: CoverX/First Mercury (sold to Crum & Forster) and Evanston, which hasn’t responded to information requests for 2 years running.  Evanston promises to provide information for the 2012 Survey.
• More carriers bringing out industry-specific products, especially for health care.
• Established EPLI carriers extending the product to their Business Owner Package-type products.
• Value-added Risk Management services continue to be added and improved.
• And lastly, but not surprisingly – real wage & hour coverage remains scarce.   We wish it were otherwise.

The results are here, although there may still be additional comments in the next couple of weeks.

Looking at those results, there is a clear preference for Information Security Insurance, which I rather like (and admittedly proposed – although I randomized the poll questions, I did make my vote public, which probably biased the results).

There have been requests to broaden the choices; I had restricted them to 5 in the interest of clarity, but maybe I need to rethink this.

Anyway – go take a look at the results for some interesting insight into how some very knowledgeable people in the cyber insurance arena see the product and its role.

Although I don’t make the decisions when it comes to naming lines of insurance, I think we all would benefit from considering some alternatives.

I have created a simple poll here.  If you would, please take a look at it and make a selection.  I’ll report back.

(and, if you don’t like the 5 choices, please provide your choices in a comment to this post)

I’ll provide a free copy of The Betterley Report Cyber Insurance Market Survey 2011 and our Middle Market Purchasing Opinions on Cyber Insurance Study to the best suggestion.  Tie goes to the first respondent and I am the sole judge.

Thanks!

Ann Marie Keim will speak about looming cyber-security risks of the moment and what defenses organizations are putting in place to counteract and anticipate these threats.  Since I believe the most advanced active cyber defense research is (I believe) being conducted by and for governmental organizations, I thought this brief article should be of interest to many of you.

You can get a copy of the Q&A article here.

Cloud computing is generally understood to mean the provision of applications and services offered over the Internet. These services are offered from data centers all over the world, which collectively are referred to as the “cloud.” This metaphor represents the intangible, yet universal nature of the Internet (thanks to TechTerms for this definition).  Cloud services include the hosting of data on the provider’s servers.

As many cyber commentators are noting, this movement of data from the insured to the cloud service provider is a material change in the exposure to loss; data are now held (and we hope protected) by a third-party.  Data in the hands of third-party service providers isn’t actually a new concept, but hosting the data on a large-scale basis is new(er).

Does this increase the risk of data breach?  Decrease it?  What are the implication for insureds, cyber insurers, and reinsurers?

Increased risk to insureds and their insurers:

• The data are out of your control; you are vulnerable to the data protection standards and execution of another party.  Will their standards be as strong as yours? Executed as well as yours?  If the standards and execution change, will you be informed?  If so, what if the changes aren’t to your liking?  What are your options?  It may not be as simple as changing providers.
• Not only is another company now holding your data, the fact that it is now concentrated in a more public (cyber) location may make it more of a target.  Hackers may not know that your data exist, but they may target the holder of your data for reasons beyond you (maybe the service provider has angered the activist hacker community, or another one of their clients becomes a target, and your data get caught up in the attack).
• What happens to your data if the service provider goes out of business?

I acknowledge that there can be contractual protections against these types of problems, but are they foolproof?  I doubt it.

• For insurers, the concentration of risk should be a worry; there is little reinsurance purchased for cyber policies, and insurers should be very concerned about a single breach that affects numerous insureds now that they are in the cloud.  Accumulation risk has always been a concern; it seems as though the cloud makes that risk exponentially greater.

Decrease in risk to insureds and insurers

• Cloud computing is often described by commentators as a one-way change in risk, but we aren’t so sure.  Many cloud users are smaller organizations, including many start-ups.  These users may not have the resources, insight, and patience to construct and maintain strong security measures.  For them, maybe the cloud is actually a safer environment.
• If an organization uses the cloud, and the vendor(s) have strong data protections that are known to underwriters, maybe it will make the job of underwriting easier and more successful?  Sometimes protecting a single point of risk can be more effective than protecting many points.

Implications for reinsurers:

• We spoke above about accumulation risk; this worry should extend to reinsurers to the extent cyber is being reinsured – but it also presents an opportunity for creative reinsurance products to protect primary insurers from a single breach/many insureds loss.

So, I think that the increased use of cloud computing brings increased risk, but also increased opportunity, for insurers and reinsurers.  Cloud risk can be managed, data protection investments can be spread over more data, and active defense (see my earlier post ‘I am growing increasingly worried…”) may be available to beat back the bad guys.

And finally – might cyber risk insurance distribution be changed from data holders buying insurance individually to it being provided by the cloud service provider?

What do you think?

I had several readers ask me to try harder, so I have.  Recently, I asked the participating carriers directly for their estimate of the market size; I received numerous answers.  Here are the ones that I thought were most useful:

• $2 billion (this is from 2 major carriers + 1 reinsurer)
• $2.5 billion (from 2 carriers)

I believe about 1/2 of this premium is written by the 4 largest writers of MLI products.

So, there you have our estimate – $2-2.5 billion in gross written premium for U.S.-based Private Company Management Liability products.  I’d be interested in your estimates (or comments).

I can’t think of another line of insurance where the exposure to loss is created (in large part) by a hostile, active, and motivated opponent – the for-profit hacker.  Cyber insureds are under constantly evolving, widely dispersed, attack, and cyber insurers are going to pay for the results of those attacks.

What other lines of insurance protect against risk that is actively generated by persons primarily from outside the organization?  Not many come to mind, other than Kidnap & Ransom and portions of a Blanket Bond (financial institutions, jewelry stores, etc.), cargo theft, and high seas piracy.  While each of these lines of insurance cover losses caused by some very capable opponents, they are pretty well understood and I would say manageable from a security standpoint.

When it comes to liability insurance and Workers Compensation, we have always worried about the ability of the plaintiff’s bar to create new theories of liability, but these tend to evolve slowly, giving insureds and insurers time to evolve and adapt.

But what about cyber?  Here we have a constantly changing source of threats, some of them quite sophisticated, and they can be tweaked almost instantly to counter potential defenses.  Techniques and tools can be updated quickly and shared with other black hats.  Deployment is rapid, widely dispersed, and adaptable.

Now, compare this with an industry that has to essentially rely on the insured to manage its own defense, relies on an annual process of applications that provides only a snapshot of the exposure at the time it is completed, and which is admittedly challenged at identifying the true risk of loss.

I am immensely impressed with the best of the cyber underwriters, but I am worried that they are outgunned.  Underwriting tools may never be able to keep up with the bad guys.

What the industry will increasingly need to rely on is not a passive Maginot Line of defenses, but active defense.  Wouldn’t it be great if an underwriter could require insureds to be subscribers to an active defense services provider and enjoy the confidence that the insured is being protected on an ongoing basis.  Is such a service even available?

More later…

We have selected twenty-three carriers for this year’s Survey, up from twenty in 2010. Newly added carriers include Argo and Zurich; Starr is back after a one year absence.

2011 looks to be similar to 2010, but with a definite firming of rates indicated as the year develops.  While we do not expect any significant increase in rates, discounts are disappearing, and small (5% or so) increases are more common.

The volume of business (gross written premium) is rising a bit, with most carriers reporting total premium growth in the 0-10% range; markets reporting flat or down premiums tend to be the smaller companies, as continuing softness in rates combined with cutbacks in coverage made for an environment in which a carrier was happy just to get as much premium as they did from the expiring policy.  We see support, though, for premiums to resume their climb as insureds recover from the recession.

Based on confidential conversations, we found:

• Premium growth (2011 projected versus 2010) is rising slightly, accelerating as we get further into the year.
• Rates are flat or up 5 to 10 percent for good insureds, a bit more (10 to 20 percent?) for the less attractive insureds
• Deductibles are flat
• Reinsurance support is stable.

Although carriers continue to broaden the types of coverages they offer the middle market, we believe they are missing a golden opportunity by not offering more coverage options.

Adding more coverage options can be a successful product strategy because MLI policies are an easy sell to insureds and their brokers – most insureds need at least a couple of the core coverages (EPL and Fiduciary).  Adding additional coverages to an existing policy is an easier buy (or sell?) for many insureds, who find it easier to add an option than to buy an entirely new policy.

Many insureds and brokers have told us over the years that they can get internal support for an added coverage option that would have encountered resistance as a new policy purchase.  This was especially true during the recent soft market, when premium reductions freed up budget for additional insurance purchases.

More about lines of coverage soon (or, read the full Report at www.betterley.com).

The increase in the number of new carriers was driven by the land rush of insurers to the new big thing in specialty insurance – privacy coverage (which while not new is getting much more mind share from agents and brokers).  Subscribers were asking about carriers that we weren’t covering which, on investigation, had products worthy of inclusion.

Next year we are going to try to whittle the size back down, probably by unwinding some of the Tech E&O coverages that have found their way into the Cyber report (we cover Tech E&O in a separate report each February).

More later (I said on July 7th); later has finally arrived.

Here are some more snips from our Cyber Report:

Annual premium volume information about the U.S. Cyber Risk market is hard to come by, but in reviewing the market, we have concluded that the annual gross written premium is in the $800 million range (up from $600 million in last year’s Report).  We suspect that the market will continue to grow, as protection against privacy breaches and the growing importance of post-breach response (also known as remediation) services drives the market.

Privacy coverage is clearly driving the market; Cyber Risk seminars and conferences are packed with prospective customers, carriers, brokers, and attorneys interested in privacy risk, coverage, and services.  Interest is translating into purchases, which we (and many others) have been predicting.  Management may still be thinking ‘it can’t happen here’ but as more events occur that would be covered, more Cyber Risk insurance is being bought.

Many carriers are reporting strong growth in premium.  Although we must maintain confidentiality about the details, carriers that have been significant players in the Cyber Risk market for at least several years indicate premium growth ranged from flat to over 100%.  More than one of these carriers reports growth of over 100%, while several others report between 50% and 100%.  A few were in the 10-25% range, and the others were under 10%.  This is remarkable, considering how difficult it has been for commercial property and casualty insurers to grow their top line revenue in the severe economic downturn.

Rates for Cyber Risk insurance, like the traditional commercial insurance lines, are still showing signs of softness.  Some of the smaller carriers report plans to reduce rates on the order of 5-10%, while the larger carriers indicate that rates will stay flat or perhaps down a bit (5%).  Several reported that they expect their competitors will reduce rates even further, a sure sign of a soft market.

• Note: I am increasingly concerned that the frequency of breaches is higher (perhaps far higher) than anticipated, and that current coverage arrangements may be hard to sustain.  Carriers may react to this frequency by increasing retentions, and worse, restricting limits.  I don’t think that higher rates will be the answer (though we may see those as well).