Cyber Insurance

The rising number of cyber losses is already leading to a difficult market situation for the corporate clients of the infant cyber insurance line. Insurers have meanwhile become much more cautious when it comes to providing coverage in this line. On the other hand, the EU General Data Protection Regulation (EC/GDPR) is giving rise to great uncertainty among companies - and an increasing demand for cyber risk cover. This is because many companies have understood that should they fail to comply with the GDPR, cyber risk insurance could be helpful in many respects.

Market Situation

The market for cyber risk insurance is growing rapidly. In the past five years, its premium income has increased by 23 per cent. As a result, the cyber insurance line grew more quickly than any other line during this period.

The number of losses, however, is also growing rapidly, forcing insurers to provide their corporate customers with lower insurance sums. Sums of several million euros are now difficult to take out. This is true for higher-risk industries in particular.

Premiums, too, are rising slightly in Germany, with insurers seeking to avoid claims ratios of more than 100 per cent. Compared with other European countries, however, premiums in Germany are still at a low level. For years, the German market has seen strong competition, leading to low prices and customer-friendly insurance conditions.

Outlook

Cyber risk insurance will establish itself in the years ahead. According to a forecast by Aon, insurers' revenues in this line will amount to USD 4bn by 2021. At the same time, insurers will in future consider cyber risks carefully before they underwrite the respective policies. The days when insurers provide coverage without requesting detailed risk information are coming to an end. Some companies are already seeing that the insurance cover they take out will be accompanied by terms that depend on their information security.

Market Trends

Nearly every company uses the services of external IT providers. However, since cyber risk policies usually only cover attacks on internal computer systems, risks such as, say, business disruptions due to the failure of an external cloud service provider, often remain uninsured. The problem: so far, it has simply not proved possible to integrate external IT providers into the insurance cover for corporate customers. This practice is changing slowly.

Another trend is that insurers are increasingly drawing a clear dividing line between the scope of cyber risk cover and that of other lines. Many insurers, for example, exclude products and services in their Ts&Cs in order to draw a clear line between cyber risk insurance and IT liability insurance. In particular it is manufacturers of products that incorporate ever more software who need to consider taking out additional insurance cover such as IT liability or Tech E&O.