The Need for Innovation: Why Cyber-Insurance Underwriting Must Adapt

The Challenges of Cyber-Insurance Underwriting: A Reckoning and a Call for Disruption

Insurance underwriters have always relied on data and actuarial tables to assess risk and write policies accordingly. However, when it comes to the fast-changing risk environment of cyber-insurance, the traditional methods have proven inadequate. The lack of long-standing data and the evolving nature of cyber threats have turned underwriting into a guessing game, leading to profitability gaps and unsustainable practices for insurance companies.

A Reckoning for the Cyber-Insurance Market

In recent years, the cyber-insurance market has encountered a series of challenges, ranging from ransomware attacks to costly breaches. As a result, insurance companies have faced mounting loss ratios and the need to rationalize their cyber insurance portfolios. Initially, premiums skyrocketed, but as insurers tried to stabilize the increases, they resorted to offering policies with less coverage and more exclusions and limitations. While these measures have temporarily improved profitability, they do not address the underlying problem: the lack of sophistication in the underwriting process for cyber-insurance policies.

The Dirty Little Secret of Cyber-Insurance Underwriters

A little-known secret of the cyber-insurance market is that most policies are underwritten based on self-assessment questionnaires. Unfortunately, these questionnaires often lack the necessary scientific approach to measure the true cyber exposure of applicants. Additionally, the answers provided are rarely verified until a claim is made, leaving room for potential disputes between policyholders and insurance companies. Even when questionnaires are diligently answered, they quickly become outdated as the cybersecurity landscape evolves.

Interestingly, the limitations of self-assessment in cyber-insurance underwriting mirror the challenges faced by vendor-management organizations in assessing risks associated with third-party partners and suppliers. This led to the development of third-party risk management platforms, which provide simplified views into the risk exposure of third parties. Cyber-insurance underwriters can learn from this market evolution and adapt similar approaches to enhance their underwriting process.

The Potential for Disruption in Cyber-Insurance Underwriting

To improve the accuracy and efficiency of underwriting cyber-insurance policies, insurers should consider supplementing questionnaires with continuous monitoring. While traditional third-party risk management platforms offer some metrics, the use of continuous controls monitoring (CCM) could be particularly effective. CCM allows organizations to track their internal controls for governance, risk, and compliance auditing in near-real-time. This approach could be extended to provide risk exposure measurements to cyber-insurance companies.

Insurers have the leverage to implement continuous monitoring through policy terms and bundled security products, but the challenge lies in gaining visibility into midmarket or smaller organizations. Potential solutions include partnering with managed security service providers (MSSPs) or offering combined MSSP-cyber insurance bundles that include CCM. The goal is to provide insurers with an inside-out monitoring approach that aligns with the evolving cyber threats.

The Path to a Sustainable Cyber-Insurance Market

Disruptive innovation in cyber-insurance underwriting is necessary to address the dynamic nature of cyber threats. By embracing approaches like continuous monitoring, insurers can create a market where policies adapt and provide comprehensive coverage that aligns with the evolving cyber landscape. This not only benefits the insurers’ bottom line but also ensures that customers are adequately protected.

Ultimately, the future of cyber-insurance underwriting lies in adopting methods of risk measurement that are as agile as the threats themselves. The current reliance on questionnaires and outdated data is no longer sufficient. Insurers must embrace disruptive technologies and partner with industry experts to create policies that mitigate risk effectively and instill confidence in both insurers and policyholders.

As cyber threats continue to evolve, the need for an adaptable and robust cyber-insurance market becomes increasingly urgent. It is time for underwriters to innovate and disrupt the traditional underwriting process to create a cyber-insurance market that makes sense for everyone involved.