A new report from Lockton Re is examining the preparedness and likely response the insurance and reinsurance industries would mount in the face of a major cyber catastrophe.
The hypothetical event, dubbed Ivan Wiper, is discussed in interviews with market leaders across the cyber insurance value chain. “This is an area which has been overlooked in discussions on systemic risk,” says Oliver Brew, co-author of the report, A Kaleidoscope of Possibilities: Preparing for Ivan Wiper.
Self-propagating destructive malware
“We selected a hypothetical, self-propagating destructive malware (named Ivan Wiper) and assumed a midpoint view of its impact globally. We spoke to experts across our industry to consider both understanding and impact. The views of different experts in the value chain were key to this paper,” he explains.
In the scenario, the malware, sponsored by a sophisticated criminal group affiliate with a nation state, attacks commonly used operating systems. “The goal is to explore how the cyber insurance market will respond in the aftermath of a major cyber catastrophe event. A major wiperware event,” they write.
Key findings
Among their key findings, the researchers say there is unlikely to be sufficient incident response capacity to handle claims and processing smoothly. Some reinsurers and insurers may withdraw from the cyber insurance market – there will be winners and losers, they say – but the catastrophe could prove to be a catalyst for product development. “Some parts of the value chain will have transformational changes.”
They add that such a scenario would not be existential for the industry.
Looking at past catastrophes, including hurricanes, major earthquakes and terrorist attacks, they point out that there is a demonstrable history of the industry bouncing back from a catastrophe of this type.
Assuming even a $28.4-billion event loss (all figures in U.S. dollars), the midpoint amount modelled in the scenario, they point out that this isn’t an insurmountable amount to cover. “It is certainly a capital impacting shock, but not in any way existential.”
Cyber insurance market penetration
The authors of the report do not address the low penetration of cyber insurance in the business world, nor the fear many insurers have of entering this market. They do, however, point out that a major cyber catastrophe would drive the penetration rate.
“Even in mature markets, there are still many companies that do not buy cyber insurance,” says the report. A cyber catastrophe would suddenly spike awareness about the need for coverage. “There will be a dramatic increase in demand, though now at elevated prices, creating a once-in-a-generation opportunity.”
The report cites Daniel Carr, Head of Cyber at Ariel Re who observes, “We have a habit of underwriting using the rear view mirror, instead of what’s in front of us.”
Learn more about the global cyber insurance market in the April edition of the Insurance Journal.
