Key Similarities
Standardisation in Coverage Areas
Across both lines of business, there is a degree of standardisation in coverage areas. This standardisation provides structure to the insurance offering. The benefit for (re)insurers is that risk can be controlled at the coverage area level by introducing structural features such as sub-limits, deductibles, coinsurance percentages, exclusions … etc. Insured losses can also be attributed to coverage areas thereby enabling a direct mapping between exposures and losses.
Core Coverages
Across both lines of business, some coverage areas are considered core. For commercial property, we would expect to find separate sections for buildings, business personal property and business interruption in most policies (regardless of industry vertical or geography). Similarly, in commercial cyber insurance, we expect to find separate sections for the core coverages stated in the table above.
Structure and Model Calibration
The structure established by the coverage areas provides a foundation for quantitative analysis. Loss models can be calibrated from the aforementioned exposure and loss data. With sufficient data, one can parameterise models at the coverage area level, allowing for correlations between coverage areas within the same policy.
Catastrophe Exposure
Some coverage areas are intrinsically susceptible to catastrophe losses (defined as single loss events which cause an insured loss to more than one risk). By way of example, in commercial property, a hurricane could make landfall and cause damage to multiple insureds’ business premises, while simultaneously interrupting the business operations of these insureds. An analogy in cyber insurance would be a single strain of malware which could spread across the web, wiping data from multiple insureds’ computer systems. In this example, we would expect claims from initial response expenses, data restoration, business interruption and other coverage areas, impacting multiple insureds at the same time.
Individual Risk Exposure
Some coverage areas are less susceptible to catastrophe losses. We would expect a different risk profile for these coverage areas, dominated more by individual risk losses (not catastrophe losses). In commercial property, we might expect to find coverage for equipment breakdown (often included as an optional endorsement to the main policy). Natural perils are typically excluded from this coverage, thus removing much of the catastrophe exposure. An analogy in commercial cyber insurance would be cyber crime coverage, where social engineering is the dominant attack vector and which affects individual insureds, one loss at a time.
Common Risk Metrics
A corollary of the previous points is that both lines of business lend themselves to frequency-severity stochastic modelling approaches which consider both attritional and catastrophe losses. Indeed, commercially available models (and proprietary models built by underwriting companies) consider both loss types in tandem. The risk metrics investors are used to seeing in property ILS are readily available in cyber ILS too as byproducts from the modelling process. Expected loss, standard deviation, value at risk, tail value at risk, probability of attachment / exit / breakeven, exceedance probability curves and other risk metrics are commonplace within risk evaluation frameworks (both for individual deals and for entire portfolios) and with the same lingua franca.
Standard Exclusions
While not mentioned in the table of coverage areas, it is worth noting that there are standard exclusions in most commercial cyber insurance policies, just as we would expect to find certain exclusions in most commercial property policies. War is typically excluded in both lines of business[1]. Infrastructure losses (including disruption to utilities, core internet infrastructure and telecommunication service elements) are another standard exclusion in commercial cyber. These exclusions remove major sources of systemic loss from the insurance product.
[1] There is a separate cyber war line of business for companies wanting to hedge this risk. This is a growing segment of the cyber insurance market.
Key Differences
First- and Third-Party Exposures are Reinsured
Commercial cyber insurance products typically cover both first- and third-party coverage areas. Cyber is not unique in this regard. Homeowners property policies in the United States, for example, typically include Coverage E (Personal Liability), protecting the policyholder against financial judgments and defence costs incurred from cases brought by third parties. Coverage F (Medical Liability) is another common third-party coverage area in Homeowners policies. Reinsurance business protecting property books of business usually bifurcate these distinct loss types. Third-party exposures are usually reinsured into liability treaties whereas first-party claims would find their way into property reinsurance treaties. Consequently, property ILS investors can expect a more homogeneous risk profile consisting mainly of first-party exposures.
We are seeing a similar phenomenon develop in cyber insurance. There is already precedent for reinsurance deals protecting first-party losses only, with third-party losses remaining un-reinsured or reinsured elsewhere. Having said that, these deals are not commonplace yet, and it is still usual to find both first- and third-party exposures reinsured together. Cyber ILS deals will typically have exposure to both.
This has ramifications for the loss development tail of cyber reinsurance, as third-party claims typically take longer to adjust and to reach final settlement. Loss development will be explored further in the third instalment of this series.
Nature of Underlying Risk
Examining coverage areas prompts us to consider the nature of the underlying risk. In property insurance, there is a wide spectrum of perils at play, some of them man-made in nature (e.g., house fire), others elemental (e.g., hurricane, earthquake). However, cyber insurance exclusively involves man-made perils, predominantly those arising from the activities of threat actors. To understand cyber risk is to understand human incentives. Different threat actors (cyber criminal groups, nation states, hacktivists, … etc.) have different motivations and, in most cases, these are known. We know their intended targets, preferred attack patterns and likely attack vectors. Intelligence on these threat actors, methods and targets is actively reported via structured data disseminated by the cybersecurity community. Trends in this data can be spotted and models can be recalibrated accordingly, with machine learning techniques particularly well-suited to handling this workload in real-time and able to keep up with the pace of change.
By contrast, property insurance, with its risk profile (especially tail risk) often dominated by elemental perils, is different in nature. Elemental perils do not have, and are not subject to, incentives. We would contend that anthropogenic forces are easier to understand than the natural world.
No Analogous Concept to TIV
Exposure within property lines of business is linked to the concept of total insurable value (TIV). TIV is a ceiling on how severe a single loss can become (whether fully insured or not). By way of example, Coverage A within a homeowners policy (Dwelling Coverage) protects the structural elements of a policyholder’s home (walls, floors, ceilings … etc). “Value,” in this context, would be the rebuild cost of the home. If calculated accurately, the Coverage A TIV would be the maximum loss possible to the homeowner’s dwelling. We can introduce the concept of a damage ratio, where any given loss could be between 0% – 100% of the TIV, but no greater. Policies would typically offer Coverage A insurance up to the full TIV amount.
In cyber insurance, there is no analogous concept to TIV. A company must determine the correct cyber limit to buy, often in conjunction with its agent or broker. There is nothing to prevent, at least in theory, a very severe loss blowing right through the top of the insurance tower, with the insured then forced to retain the balance. While this is a different mindset to property insurance, cyber is not unique in this regard. The same could be said for many other specialty and casualty insurance lines. This reality does not prevent or impede the ability to build and calibrate quantitative models using exposure and loss data.
