Cyber risk is likely the most significant property casualty risk to emerge in recent times. Premiums for cyber risk are growing significantly, and daily headlines bring attention to yet another major data breach affecting an entity. Most of us with credit cards have probably had new cards issued because of a breach in the last year, and many of us have had health information compromised. Throughout the course of 2015, I attended several cyber and security risk management, conferences in addition to doing extensive research on the topic. After reflecting on the information, I have compiled a summary of important actuarial issues related to cyber risk.

• Credible industry data or unique company data does not exist for most companies to assess cyber risk using solely quantitative methods. Instead, the process of evaluating cyber risk should be holistic, involving both quantitative and qualitative assessments.
• Limited industry benchmarking data does exist, however. Three example sources of data are the Ponemon Institute, The Verizon Data Breach Investigations Report, and the RIMS Cyber Survey.
• The components of a cyber risk event could involve many expense items, such as litigation, public relations, investigations, privacy breach notifications, data restoration, regulatory penalties, loss of customers, and reputational risk.
• Cyber risk is being added to some of the captives SIGMA works on. Our experience is that the risk is normally included in captives as deductible coverage or low limit coverage. Since policy types are almost always claims-made, year-end reserving is straightforward, if there is no reported or known claim as of the evaluation date.

As of May 2014, there will be a shift in language of GL policies to reflect a group of exclusions to prevent GL policies from covering cyber risk as proposed by ISO. This should increase the purchase of stand-alone cyber policies.

Cyber risk policies are difficult to compare due to an extreme lack of consistency in policy structure, language, exclusions, and coverage. Definitions of these may even vary considerably.

Cyber risk introduces broad and sweeping threats to a company. It truly is an enterprise risk and should be handled in a holistic fashion with multiple departments within a company or entity involved in managing the risk. Additionally, external experts from various disciplines should be considered for addition to a team evaluating the risk. Actuarial implications and analyses at this stage of emergence are difficult to define. However, as stand-alone policies continue to emerge, and as companies begin to include the risk in captive insurance companies, the need for analysis will become more important.

We welcome your feedback by posting a comment, or contacting Michelle Bradley at mb@SIGMAactuary.com.
© 2016 SIGMA Actuarial Consulting Group, Inc.