Differentiating Cyber Risk of Insurance Customers: The Insurance Company Perspective

Abstract

Part 1: The International Cross Domain Conference (CD-ARES 2016)International audienceAs a basis for offering policy and setting tariffs, cyber-insurance carriers need to assess the cyber risk of companies. This paper explores the challenges insurance companies face in assessing cyber risk, based on literature and interviews with representatives from insurers. The interview subjects represent insurance companies offering cyber-insurance in a market where this is a new and unknown product. They have limited historical data, with few examples of incidents leading to payout. This lack of experience and data, together with the need for an efficient sales process, highly impacts their approach to risk assessment. Two options for improving the ability to perform thorough yet efficient assessments of cyber risk are explored in this paper: basing analysis on reusable sector-specific risk models, and including managed security service providers (MSSPs) in the value chain

The invisible hole of cybersecurity insurance services

“…Others deal with the cybersecurity insurance companies (i.e. the suppliers of cybersecurity insurance services), mainly in the context of assessing cybersecurity risks (Eling & Schnell, 2016;Meland et al, 2017;Tøndel et al, 2016).…”

“…Other research examined the insurance market in different geographical zones, as well as the decision process of insurance companies relating to cybersecurity insurance and risk handling. Tøndel et al (2016) emphasized the supplier, the cybersecurity insurance companies, mainly in the Nordic market, and examined their challenges in assessing cybersecurity risk. They found that the abilities of insurance companies to evaluate risk assessment is highly impacted by limited experience with cybersecurity insurance services and little historical data to rely on.…”

“…Customers underestimate the probability of cyber-attacks to their business, leading to underestimation of the possible risks (Rohn et al, 2016). Suppliers of cybersecurity insurance services do not have enough experience and historical data, to identify, assess and evaluate the risks and the premium needed (Tøndel et al, 2016). Another aspect is the role of the insurance companies in consulting and risk assessments, as private governance mechanism in improving the organizations' cyber readiness (Talesh, 2018).…”

The cyber-insurance market in Norway

“…The Norwegian cyber-insurance market has previously been investigated by Tøndel et al , who conducted interviews with a limited number of key insurance companies offering cyber-insurance on the Norwegian market in in 2015 (Tøndel et al , 2016). This differs from our study, in that no other relevant actors such as brokers were included.…”

“…Tøndel et al (2016) aimed to identify challenges and cyber-risk assessment practices of insurance companies. However, findings were scarce as companies did not give ‘any clear priorities on which risk factors they consider most important’.…”