Updated: March 17, 2022 2:15 PM
Industry experts from left, moderator Tracey Gibbons, Patrick Bousfield, Ari Chatterjee and Noel Pearman (Photograph by Jessie Moniz Hardy)
Outdated war exclusion policies in the insurance industry could lead to billions in losses in the event of a major cyberattack.
That was the opinion of industry experts in Bridging the Cyber Coverage Gap, a panel held on day three of the Bermuda Risk Summit 2022.
“The wording is based on the assumption that we could define war,” said Noel Pearman, senior vice president of cyber product line at AXA XL.
But he added that during a cyberattack it could be “extremely” difficult to tell who was attacking and what their motives were.
“Hackers are so sophisticated that they can mimic attack styles of other countries to make it look like another country attacked, not the actual attacking country, or a group of people friendly to the country,” Mr. Pearman said.
“So in terms of the effectiveness of war exclusion, I think that’s a question that’s up in the air. I don’t think it’s going to be hugely effective right now. I think there’s has modifications coming to market that will help.
He said one of the changes could be to state “we will not cover a cyber incident following an attack, which is in support of true ground warfare.”
“It clarifies exactly when an exclusion would and would not apply and takes the terrorism component out of it,” Pearman said. “It could help, but it will be very difficult in the meantime.”
Yosha DeLong, senior vice president, global head of cyber at Mosaic, said if current war exclusions don’t hold up in the face of a zero-day cyberattack, the result could be as high as $60 billion in losses.
Other panelists estimated between 20 and 40 billion losses.
“I think the wartime exclusions are part of the original property exclusions,” Ms. DeLong said. “Some of them are almost 100 years old. They are not built at the moment. It’s the only thing we have to do.
Ms DeLong said each carrier has a different policy and different wording. Something as simple as a comma or the word “and” could be the deciding factor in whether the war exclusion could be invoked.
“So that’s something that we as a community are looking at right now, looking at what we intend to cover and what we don’t intend to cover, and do we address that properly,” she said.
Lockton Re’s principal broker, Patrick Bousfield, said Russia’s attack on Ukraine has not led to an increase in ransomware attacks so far.
“If you study the ecology of ransomware and bad actors, they’re happening in those two countries,” Bousfield said. “There are rumors that these bad actors and entities are waging a civil war right now, so they’re a bit too busy to pursue profit.”
But he said indirect attacks were something to consider.
“There are other threatening actors out there,” Mr Bousfield said. “They are going to enjoy this moment. It takes a lot of investment to have a very broad impact, but you could very well see a digital nuclear bomb going off in certain sectors. Oil and gas would be the most likely.
But Ms DeLong said the insurance community had done a very good job of focusing on checks over the past two years.
“It’s really essential to prevent this particular event if it escalates into a disaster for the industry,” she said.
Ari Chatterjee, director of underwriting at Envelop Risk, said that to make growth sustainable, it was important to find solutions.
“We need to find more sources of capacity outside of the traditional market,” he said. “I think we still need to improve our risk quantification and be ready for some of the terrible things that can happen, and have the capital ready to back up if necessary.”
Tracey Gibbons, Head of QBE Re, was moderator of the panel.
The Bermuda Risk Summit 2022 was held at the Hamilton Princess & Beach Club and was organized by the Bermuda Business Development Agency.