The global economy has so far proved to be resilient to material, widespread financial loss from cyber attacks, although data from near-miss events shows that the threat remains.
This is amongst the findings of a report just published by cyber analytics firm, CyberCube, whose analysis suggests that while few security issues have become major re/insurance losses, the counterfactuals on observed near-miss events suggest that far larger losses are quite plausible.
The firm analysed over 100 global cyber aggregation events with catastrophic potential over the past six years – equating to about one every three weeks. The vast majority of those events were resolved by the cyber security community with minimal financial loss to insurers.
CyberCube’s ongoing review of cyber threat trends and has been reflected in its software-as-a-service solution Portfolio Manager Version 5. PMv5 enables stress testing of portfolios against a range of systemic cyber-related scenarios including data breaches, cloud outages and global ransomware attacks.
Jon Laux, CyberCube vice-president of analytics and report author, said: “Understanding the nature and potential extent of cyber catastrophe risk is absolutely essential for a sustainable cyber re/insurance market. For PMv5 we reviewed nearly every aspect of our model to provide a coherent view of risk – driven by a combination of deep expertise and data and organised so results make sense for both technical users and senior decision makers. We hope this model serves as a basis for the critical business decisions the industry needs to make.”
The industry is exploring how policy language can contain re/insurers’ exposure to cat scenarios and what this could do to reduce capital requirements. CyberCube found that some approaches could yield modest results while others could have more significant benefits. To illustrate this, an analysis of the CyberCube US Industry Exposure Database indicates that the 1-in-100 year US cyber insurance industry loss could be reduced by up to 65% with the implementation of stringent widespread event language.
