The cyber insurance market is undergoing a fundamental transformation, evolving from its roots in data breach liability to become a complex, multi-faceted response mechanism for a constantly shifting digital threat landscape.<\/p>\n\n\n\n
That was the view from industry leaders at a recent cyber insurance panel, hosted by AdvantageGo, the second in a quarterly series of such events, at which two leading cyber insurance experts debated the expanding scope \u2014 and mounting challenges \u2014 of cyber cover.<\/p>\n\n\n\n
\u201cCyber insurance has always been reactive,\u201d said Shannan Fort, international cyber product leader at Marsh. \u201cThe product is constantly having to play catch-up with technology and the changing nature of cyber threats.\u201d<\/p>\n\n\n\n
Fort noted that in its early days, the cyber market was laser-focused on privacy liability, particularly in the United States, where litigation culture and regulatory regimes drove demand.<\/p>\n\n\n\n
\u201cYou could almost track the cover with litigation and regulatory changes,\u201d she said, pointing to the rise of incident response coverage as a shift towards more proactive mitigation.<\/p>\n\n\n\n
James Tuplin, head of international cyber at Mosaic Insurance, offered a complementary perspective from the underwriting side.<\/p>\n\n\n\n
\u201cThe policy language got broader and broader, but underwriting lagged behind,\u201d he said. \u201cEveryone was making money and selling the product \u2014 until ransomware hit.\u201d<\/p>\n\n\n\n
Both panellists agreed that ransomware has been a critical inflection point.<\/p>\n\n\n\n
Fort observed that while clients have long recognised the seriousness of the threat, the market\u2019s contraction a few years ago prompted a more disciplined focus on resilience and controls.<\/p>\n\n\n\n
\u201cContrary to popular belief, the first port of call for clients is not to pay threat actors,\u201d she stressed. \u201cNobody wants to reward criminal behaviour \u2014 that is always a last resort.\u201d<\/p>\n\n\n\n
Tuplin reflected on how ransomware changed the underwriting approach.<\/p>\n\n\n\n
\u201cThe coverage was there, but we didn\u2019t know what questions to ask,\u201d he said. \u201cWe had to go back and figure out: what is this risk, how does it manifest, what are the controls that make it insurable?\u201d<\/p>\n\n\n\n
The conversation then turned to the growing complexity of cyber cover, particularly in relation to business interruption (BI) and contingent business interruption (CBI).<\/p>\n\n\n\n
Tuplin expressed unease with the growing push to incorporate wider risks into a single cyber policy. \u201cEffectively, clients want it to be an \u2018all-risks\u2019 policy,\u201d he said.<\/p>\n\n\n\n
\u201cLovely in theory, but if a cyber event causes property damage or involves terrorism, I have to understand how all of that plays out. It becomes impossible to underwrite well.\u201d<\/p>\n\n\n\n
Fort pushed back on the idea that a single policy should do everything.<\/p>\n\n\n\n
\u201cWe don\u2019t expect one policy to respond to every impact of a fire \u2014 why would we expect that for cyber?\u201d she argued. \u201cWe\u2019ve allowed traditional markets to offload cyber risks by excluding them, but that doesn\u2019t mean we should stretch the cyber policy to compensate for that.\u201d<\/p>\n\n\n\n
Their debate intensified around contingent BI and supply chain risk \u2014 widely acknowledged as among the thorniest issues in cyber underwriting<\/a>.<\/p>\n\n\n\n Tuplin cited the opacity of supply chains beyond tier-one suppliers as a major challenge. \u201cWe don\u2019t have enough visibility,\u201d he admitted.<\/p>\n\n\n\n Fort countered that she thought underwriters have been overcomplicating the problem.<\/p>\n\n\n\n \u201cYou\u2019re underwriting the insured\u2019s resilience,\u201d she said. \u201cNot every risk comes down to knowing every supplier\u2019s supplier. The question is: how quickly can the insured respond and recover?\u201d<\/p>\n\n\n\n