Cyber Insurance: Brokers’ Key Questions Answered

Cyber Insurance: Brokers’ Key Questions Answered

This interview is part of a special report published by Insurance Business Canada.

Michael Kalakauskas, Trisura’s assistant vice-president and product manager of professional liability and cyber liability, recently shared his perspective on key cyber trends and what brokers need to keep in mind.

IB | What key market trends should brokers be aware of in the cyber insurance space in 2019?

IB Special Cyber ReportI would place key market trends into two different categories: cybersecurity trends and cyber coverage trends. Both categories should be front of mind for brokers, not only in 2019, but in the years to come as well, as they allow brokers to think of exposure, risk and insurance solutions simultaneously.

From a cybersecurity trend standpoint, the sheer volume of cyber attacks and compromised personal information on a worldwide level is at an all-time high and will only continue to grow with the expansion of things like company interconnectivity, the Internet of things, the use of cloud services, artificial intelligence and machine learning, automation, and small to medium-sized business vulnerability.

These trends are at the heart of cybersecurity and point to the need for all organizations to increase their security and awareness in protecting themselves against cyber attacks and data breaches. Cyber criminals and attackers are only getting more sophisticated, so as an industry, we need to keep up with, and respond to, emerging threats. Another important trend from a cybersecurity standpoint is the evolving landscape of international data privacy laws and government/regulatory body involvement.

From a cyber coverage standpoint, brokers need to be aware that third-party liability coverage for data breaches is only one piece of the overall cyber insurance puzzle. The trends from a coverage standpoint – and the biggest causes of current cyber claims, in Trisura’s experience – are ransomware, social engineering and business interruption. Not all businesses carry large amounts of personal data that data breaches might target; however, all businesses are dependent on computers, cell phones and the internet, ultimately making them vulnerable to different types of cyber attacks.

The one thing all companies do hold is employee data, so all companies are exposed to a potential data breach. Our experience, though, is that the coverages I mentioned are the ones most sought after by small- to medium-sized businesses. It is easier to target small- and mid-sized companies, as they may not have adequate security measures and resources in place to protect themselves. Small companies must reassess their security position and ensure adequate measures and controls are implemented to safeguard against today’s cyber attacks.

IB | Which client groups should be the target markets for cyber insurance this year?
All client groups! All businesses – small, medium or large – have cyber exposures, and each company should be having conversations with their insurance broker about adequate cyber insurance coverage and risk transfer options.

That said, I would prioritize some of the industries that have not previously bought cyber insurance on a widespread basis. Industries including finance, banking, healthcare, retail and hospitality – all well known for holding and using personal information – have already been exposed to cyber insurance and the risk of data breaches; however, industries like construction, transportation and manufacturing, as well as smaller professional offices, are slowly being exposed to the importance of cybersecurity and need more awareness in this space.

At Trisura, we are trying to increase the exposure of cyber insurance with all our small- to medium-sized business clients, regardless of industry type. As mentioned, it is easier to target small- and mid-sized companies, as they may not have adequate security measures and resources in place to protect themselves. Trisura has a large surety book that comprises clients of all sizes in the construction industry – for example, builders, developers and contractors – and with them being more reliant on technology and computers, it is imperative we offer cyber solutions as part of their overall insurance and surety bonding package.

Likewise, we insure many small- to medium-sized professional offices for E&O and directors & officers liability and are currently trying to target them for cyber coverage as part of their insurance portfolio.

IB | How can brokers overcome the “it won’t happen to me” mentality held by many smaller businesses in reference to cyber attacks?
All businesses, regardless of size and industry type, have cyber exposure. Regardless of whether they hold or store their customers’ or suppliers’ personal data or corporate information, they have data on all of their employees that is at risk. Furthermore, all companies are reliant on computers, cell phones and the internet, and therefore would be susceptible to loss in the event of a cyber attack like ransomware, a hack, data loss, payment diversion or phishing, malware, and software or hardware failure.

Cyber attacks are indiscriminate. Even if it’s not from an attacker, one of the biggest forms of cyber exposure is the error of an employee clicking the wrong link, sending an email to the wrong person or leaving an unencrypted laptop or cell phone at a public place. Cyber exposure could come from anywhere, and if it were to happen, it could give rise to significant financial loss.

My rule of thumb is to advise businesses that cyber attacks are not a matter of ‘if ’ but more of ‘when’ – and whether the company is able to withstand the financial impact of such an attack or loss. If the company is not equipped to sustain such an attack, or the business would like some additional protection, then cyber insurance is a key to their risk management process, no matter the size of their business.

IB | What are the key differences between cyber as a stand-alone product and as an add-on? In which situations should brokers consider one option the better choice for clients?
The key difference between a stand-alone cyber product and an add-on by endorsement is the quality of the coverage and of the claims service. With a stand-alone cyber policy, you are getting a dedicated product – and limits – with specific and broad coverage and, most likely, access to a comprehensive cyber response team that can help navigate any claim or cyber incident. Most add-on cyber endorsements cover such a limited amount, and language tends to be very restrictive. Furthermore, add-ons usually contain such a small limit of liability, or the limit itself is shared with the main policy limit.

My hope is that add-ons become less and less used in the industry and that all clients – again, regardless of size and operation – purchase a stand-alone cyber policy to properly cover themselves. Another advantage of a stand-alone policy is that it is most likely being managed by a dedicated and experienced cyber underwriter. A true cyber underwriter can not only help with exposure and risk identification, but can also tailor the cyber policy and coverage to the specific needs of the client. Most add-ons are offered by underwriters in the professional liability or casualty space, and they may not have any expertise in the field whatsoever.

IB | What are the vital elements of a good cyber insurance policy, and which elements are particularly important for different clients?
Overall, good cyber insurance provides coverage for both an insured’s first-party and third-party losses associated with a network security breach, or the loss, theft or unauthorized disclosure of personal information or confidential corporation information. The coverage should include expenses related to breach notification, extortion threats, public relations, credit monitoring, forensic investigation, defence costs, the costs of judgments or settlements, regulatory claims, business interruption, and media liability, among other things. Every business has an exposure and should be protected accordingly. Exposures come in the form of employee information, customer information, internet access, electronic and network activities, and the overall use of technology.

Specifically, the most important element of any good cyber insurance policy is the claims handling service and response team associated with it. A cyber insurance policy should give clients access to experts in all fields of cybersecurity and make them feel comfortable throughout the whole process, whether it is a full-blown claim, a possible breach or a system hack. A good response team should include law firms and breach coaches, forensics and investigation professionals, public relations and communication specialists, and breach notification, identity repair and credit monitoring firms.

Legal experts can help minimize the risk of litigation and fines in the wake of a breach. They can provide legal advice based on your specific incident, such as determining how to notify affected individuals, government agencies, third parties and others who may be impacted. The law firms and breach coaches can also manage breach response teams and oversee all aspects of the response.

Forensic and investigative providers can advise your organization on how to stop the current data loss, prevent further harm and secure evidence as necessary. They can also determine where, when and how the breach or hack occurred, analyze data sources to determine what information has been compromised, and assist in data restoration.

Public relations providers can help develop both the internal and external communications needed during an incident, as well as oversee crisis management services. They can also provide advice on how to best position the incident to key audiences, update social media and help manage media questions related to the issue.

Breach notification providers can help in the form of credit monitoring, credit reports, call centre services and direct mail campaigns.

 

 

What’s new in specialty lines?

What’s new in specialty lines?

This article was originally published by Canadian Underwriter on June 5th, 2019

Read the original article here.

Author: Jason Contant

 

Chris Sekine, the new president and CEO of Trisura Guarantee Insurance Company, reveals the hottest of the hot opportunities in commercial insurance lines right now.

cu | Before we hear your thoughts about business insurance, let’s first talk about your new role. You recently took over the helm at Trisura Guarantee Insurance Company from Mike George. How is it going so far?

CU article with Chris Sekine It’s been going very well, and I’m excited to be in the role of CEO. Last year was one of Trisura’s best years ever and we are well-positioned for the future. Over the past couple of weeks, Mike and I have been travelling together and attending a few industry conventions. The timing has been good because we were able to have fun, connect with many of our brokers and highlight together that it’s business as usual for Trisura. Mike has been my friend and mentor for many years and he has been instrumental in helping me with the transition into my new role.

I’ve been with Trisura since the beginning and plan to build on the strategy and formula that has made us successful. A critical part of that is our great team of people who create exceptional experiences for our brokers and their clients. We will continuously work to improve our service levels and product offerings.

cu | Okay, let’s talk about commercial lines. What would you say are the key trends in this area?

Commercial lines is a broad area with different trends. Since Trisura is a specialty lines company, I’ll speak more to our specific lines of business — namely D&O, E&O, fidelity, media, cyber and surety — as opposed to commercial insurance in general.

From a D&O perspective, boards and directors need to be aware of a lot of emerging risks — including climate change. How much information a company discloses about its climate change risks and opportunities, as well as how it discloses the information, can each have a material impact on share price and valuation of the corporation.
Another developing risk is the #MeToo movement. This is a unique exposure that hits all parts of our D&O book of business, including non-profits, private companies and public companies. It continues to be a relevant consideration for company board members and it continues to affect claims activity.

The health of the Canadian economy over the next 12 to 14 months is one of the bigger emerging exposures we are watching. I’m sure you could speak to many different economists and they will all have varying opinions. Certainly, a large risk would be for the economy to head into a downturn over the next couple of years. Companies will need to be ready, especially if there is tightening of credit. A potential catalyst is a change in government and the effect on government spending. The risk is particularly relevant to the construction sector, for example. There are a lot of political unknowns that could affect the economy. For example, there was a change in government in Alberta recently; there’s a federal election coming up later this year; and there will be a U.S. election next year. A lot is going on globally that could potentially affect Canada and the commercial insurance business.

cu | What advice do you have for brokers selling commercial lines?

Not surprisingly, I think one of the biggest opportunities is cyber liability. It’s an often-misunderstood exposure in terms of what exactly the exposures are and what the policies cover. Many brokers say to us: “My client doesn’t have a cyber exposure.” But I think the word ‘cyber’ doesn’t do the product justice. Everybody associates cyber with the internet; we see it as a potential data breach that can come in various forms, putting every company at risk. For example, let’s say a file with private information is left in a person’s vehicle. If the vehicle gets stolen with that file in the car, that is a data breach that doesn’t involve the internet. If brokers can give their clients a complete picture of the various ‘cyber’ exposures, and if they can help clients choose from among all of the coverages available for those exposures, that’s a big opportunity for brokers to set themselves apart. They can win clients by being a trusted advisor.

cu | What trends are you seeing in cyber?

We are starting to see a bit of a shift in the types of claims. Over the past one to two years, we’ve been seeing a lot more in terms of ransomware demands. For example, a company with 200 employees experiences a system shutdown; they can’t do anything until they pay bitcoin to get the system unlocked. Having the proper coverage with the right carrier can address that. Depending on the coverage, the carrier could pay for the ransomware demand, the system restoration costs and first-party expenses. Brokers will know what coverages are available to their clients.

cu | How does cyber coverage mix or not mix with CGL policies?

A CGL policy is a commercial general liability policy, not a cyber general liability policy. The CGL policy is not designed to pick up cyber exposures. If you have cyber exposures, you should buy a cyber liability policy. It provides third-party coverage for liability in addition to first-party coverage for expenses related to ransomware, system restoration costs and business interruption. Our advice is that if a broker’s client has a specific concern, buy a policy that’s designed for that specific exposure rather than just crossing your fingers and hoping the CGL policy will respond. The CGL won’t provide the same breadth of coverage that you can get in a standalone cyber product.

cu | We’ve heard the surety line is hardening. What’s happening there?

Actually, I don’t think the surety market is hardening. It might not be softening, but I don’t think it’s hardening. In my view, the surety market is relatively stable. If anything might lead some to believe there’s a hardening, it’s because of some fairly notable, large construction failures over the last little while. However, I don’t think that’s really had a significant impact on terms and conditions offered in the industry. Certainly, I don’t think it’s been that influential here in Canada in terms of behaviour of surety underwriters.

cu | Are you looking at moving into any new lines of business?

As we move forward, it’s really about looking for ways to expand our capacity and appetite within our existing lines of business. If we look at new lines of business, they will be adjacent to lines of business where we are already. Over time, we’re hoping to leverage the capabilities of Trisura Group Ltd., our parent company, which went public two years ago and is trading on the TSX. Trisura Group Ltd. has two other subsidiaries: 1) Trisura Specialty is our U.S. affiliate, focused on excess and surplus business, which resembles our risk solutions business; and 2) Trisura International is a reinsurance arm in Barbados.