Adam Peckman | Aon Risk Solutions

Adam Peckman of Aon Risk Solutions reveals Aon’s first captive cyber survey results and explains how a captive can challenge the evolving threat of cyber risk

What were the main findings of the report?

Indicative of both the rapid application of new digital strategies, growing dependency on technology to support critical business processes, and the evolving threat environment, business interruption due to a breach was rated as the top cyber risk concern for the participants in our recent survey. Meanwhile, bodily injury/property damage (first and third party) was rated as their lowest concern.

Additional highlights include that only 59 percent of companies have used a formal risk assessment process to help inform their insurance buying decision, and a mere 51 percent of companies would value an independently administered cyber risk assessment.

Some 61 percent of survey respondents said they buy cyber limits in the $10-25 million range, but overall, 60 percent of large companies don’t buy cyber insurance. Of those that do, 68 percent of companies surveyed buy cyber for balance sheet protection, making this the most popular reason, closely followed by ensuring due diligence comfort for the board.

The survey found that 25 percent of respondents that buy limits are confident that they comply with international best practices and standards for information security governance.

Also, 95 percent of companies stated clear policy wording as the most important issue in the cyber risk market, and 75 percent of large companies expressed concerns about the loss adjustment process. Finally, the survey shows that 94 percent of companies would share risk with others in their industry as part of a captive facility writing cyber.

Do you expect to see an increase in the number of companies using captives to cover cyber risks?

Aon’s Captive & Insurance Management team anticipates alternative risk transfer options to become increasingly sought after, as these solutions give companies some control over underwriting, coverage scope and claims adjustment, while providing an opportunity to share best practices, experience and data in a private setting.

Consequently, the extent to which these alternative risk transfer options are pursued will depend on the market’s ability to keep pace with client needs.

In Aon’s Captive Benchmarking Survey, participation in cyber by captives rose by roughly 30 percent in 2016, and this trend of growth is expected to continue.

Should larger, sophisticated companies not perceive the market keeping pace with their requirements, it is foreseeable that there would be industry type mutual entities established to give some control over underwriting, coverage scope and claims adjustment.

What are the benefits of a company funding cyber through a captive?

Our study has shown that for many companies a divergence still exists between recognising cyber as a fast evolving risk to the corporate balance sheet and understanding the coverages required to best mitigate the exposure—71 percent of surveyed companies listed terms and conditions as their most important issue in the cyber risk market place.

This was followed by pricing, highlighted by 48 percent.

Accordingly, captives are a great alternative risk transfer solution for bridging this divergence while solutions from the insurance industry catch up to meet the challenge of this evolving cyber risk frontier.

By including cyber risk in a captive, rather than simply self-insuring the risk, the company gets the opportunity to evaluate how the risk will behave in a formal insurance structure subject to underwriting and claims adjustment disciplines.

Over time, that experience and data can be used to negotiate programme structures with insurance carriers and to inform cost allocations of cyber loss.

Insureds place cyber exposures in captives for a number of different reasons: