The Big question: Is the new LMA cyber framework a catalyst for underwriting change?

Cyber risk is not new but the rapid development of technology and its increasing role in both business and personal lives has created a demand for cover but it is accompanied by a new breed of risks and exposures.

It has prompted a significant degree of investment in modelling capabilities given the systems nature of some risks and the interconnectedness.

However, while there has been significant modelling around core cyber risks there has been a recognition from many areas of the market that there are some significant risks which are still not fully understood.

In response the Lloyd’s Market Association (LMA) has released a report on a new framework which has been designed to support the market and its efforts to understand and quantify lesser known ‘other cyber’ scenarios.

The LMA explained while systemic scenarios such as the failure of a cloud service provider or a widespread ransomware attack have been intensively modelled by the insurance industry, the rapid digitalisation of society is creating new cyber risks with which insurers are less familiar.

Ian Summers, Global Business Leader, AdvantageGo.

Kelly Malynn, Underwriting Product Leader for Cyber Physical Damage M.A.P at Beazley and chair of the LMA’s Cyber Risk Strategy Group, says the framework is an example of the importance of the LMA’s support in helping members to understand cyber exposures.

She adds: “This new LMA framework is very timely and will be of real practical value to the market.

“In the digital age, the rise of cyber security threats and incidents has led to an increased focus on cyber security and cyber insurance. Within the insurance industry, there is a growing focus on the maturity and completeness of cyber event quantification from company boards, capital providers and regulators.”

Malynn continues: “While cyber modelling remains, relatively speaking, in its adolescence, the potential insured impact of these systemic events has been reviewed frequently by risk modelling vendors, Lloyd’s, regulators and internally within many insurance companies.

“However, given the increase in digitalisation of almost every industry, there is an ever-growing number of ‘other cyber’ scenarios that could occur. While these scenarios may not reach the severity of the four most common events, they can still result in material losses in specific industries with common nodes of aggregation, with any insured losses likely to be focused outside or in addition to the standalone cyber market.

“This report seeks to provide insights for executives, underwriters of all classes and claims managers into the potential of other cyber exposures associated with increasing digitalisation in the industry.”

She adds: “One of the standout features of our report is its focus on the aggregation potential of cyber risks – particularly these lesser-known ‘other cyber’ scenarios. The interconnectedness of modern systems means that a single point of technological commonality can lead to widespread disruptions, underscoring the necessity for advanced risk modelling and comprehensive scenario planning to facilitate informed underwriting.”

Malynn continues: “Anyone with a reliance or dependency on technology or software faces a wide range of risks. What we know is that with cyber incidents they are class agnostic and threaten companies and organisations of all sizes.”

While the big ticket systemic risks have been heavily modelled such as cloud service provider (CSP) outage, a widespread ransomware attack, mass data breach, and critical infrastructure blackout, other risks such as an event involving a software as a service (SAAS)  or other service providers are becoming an ever more important part of business and Malynn says that at present the ability to truly quantify the exposure and aggregation risks is limited.

“What the framework can do for underwriters is give them a range of potential losses which can allow underwriters to better consider the risks,” she explains. “The LMA Cyber Strategy Group has been running for six years and contains members who bring with them skills from across the market which are looking to create solutions on behalf of the LMA membership.

“The report enables the LMA to share out information with members and the wider market on what is a significant risk.”

On whether the framework will act as a catalyst for underwriters to write more cyber business Malynn adds: “There is a lot of language around exclusions in the market and when it comes to cyber there has been an acknowledgement of the potential exposures but concerns around how you can best understand them.

“While individual companies will adopt their own approach to cyber and particularly the lesser known cyber risks it remains clear that if you can understand the risk then you are in a better position to underwrite it. The industry is always keen on data on which it can base underwriting decisions and when data is scarce there is a reluctance to commit capacity. What we hope the report and the framework will do is deliver a greater degree of clarity for underwriters across the market.

“It is a risk which goes across classes and across the industry. We need to come up with new solutions and new approaches to new risks that our clients face. London has always been keen on delivering innovation and the committee has worked to look at ways we can support members and with it the wider industry in what are very complex and challenging risks.”

Malynn explains: “The framework can enable underwriters to review their strategies and the way in which we think about these risks. It takes a new approach to understanding aggregation and how to calculate its impact.”

Footnote: The report and its findings are all considerations that AdvantageGo cyber focussed solutions are built around and upon.