Cyber Risk emerges in the Property & Casualty Market - Reflections on a Year of Education and Research

Michelle Bradley, ACAS, MAAA, ARM, CERA, CCIS

Cyber risk is likely the most significant property casualty risk to emerge in recent times. Premiums for cyber risk are growing significantly, and daily headlines bring attention to yet another major data breach affecting an entity. Most of us with credit cards have probably had new cards issued because of a breach in the last year, and many of us have had health information compromised. Cyber Risk Throughout the course of 2015, I attended several cyber and security risk management, conferences in addition to doing extensive research on the topic. After reflecting on the information, I have compiled a summary of important actuarial issues related to cyber risk.

  • Credible industry data or unique company data does not exist for most companies to assess cyber risk using solely quantitative methods. Instead, the process of evaluating cyber risk should be holistic, involving both quantitative and qualitative assessments.
  • Limited industry benchmarking data does exist, however. Three example sources of data are the Ponemon Institute, The Verizon Data Breach Investigations Report, and the RIMS Cyber Survey.
  • The components of a cyber risk event could involve many expense items, such as litigation, public relations, investigations, privacy breach notifications, data restoration, regulatory penalties, loss of customers, and reputational risk.
  • Cyber risk is being added to some of the captives SIGMA works on. Our experience is that the risk is normally included in captives as deductible coverage or low limit coverage. Since policy types are almost always claims-made, year-end reserving is straightforward, if there is no reported or known claim as of the evaluation date.

As of May 2014, there will be a shift in language of GL policies to reflect a group of exclusions to prevent GL policies from covering cyber risk as proposed by ISO. This should increase the purchase of stand-alone cyber policies.

Cyber risk policies are difficult to compare due to an extreme lack of consistency in policy structure, language, exclusions, and coverage. Definitions of these may even vary considerably.

Cyber risk introduces broad and sweeping threats to a company. It truly is an enterprise risk and should be handled in a holistic fashion with multiple departments within a company or entity involved in managing the risk. Additionally, external experts from various disciplines should be considered for addition to a team evaluating the risk. Actuarial implications and analyses at this stage of emergence are difficult to define. However, as stand-alone policies continue to emerge, and as companies begin to include the risk in captive insurance companies, the need for analysis will become more important.

We welcome your feedback by posting a comment, or contacting Michelle Bradley at
© 2016 SIGMA Actuarial Consulting Group, Inc.

Leave a Reply

Your email address will not be published. Required fields are marked *


Recent Posts

Analytical Strategies for Large Deductible Policies
When companies are determining a large deductible policy structure for their P&C risks, it is unfortunately all too common for the final decision to be based on “back of the napkin” calculations. This is often due to a lack of time, resources, or comfort in using more effective analytic...
Read More
Optimizing Your Large Deductible Policy
Large deductible policies provide companies the opportunity to reduce their insurance premiums in exchange for a portion of the retained losses from a covered risk. In some cases, the amount retained by an insured is based on costs from individual claims or occurrences, but it might also be based on...
Read More
Mid-year 2023 Actuarial Report Prep 
Quarterly or semi-annual actuarial reports can help eliminate year-end surprises and manage overall financial reporting. This may be particularly helpful if your company has had significant changes during the year such as growth, acquisitions, divestitures, changes in third party claims administrato...
Read More
Legislative Changes and Captive Actuarial Analytics
In a recent article published by Captive International, Michelle Bradley and Enoch Starnes discuss “Legislative Changes and Captive Actuarial Analytics”. In it, they examine recent legal developments in the United States and how they might affect the captive insurance industry. The insurance w...
Read More

Subscribe to Our Blog

hello world!
Copyright © 2023 SIGMA Actuarial Consulting Group, Inc. All Rights Reserved.
chevron-down linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram