Cyber Risk emerges in the Property & Casualty Market - Reflections on a Year of Education and Research

Michelle Bradley, ACAS, MAAA, ARM, CERA, CCIS

Cyber risk is likely the most significant property casualty risk to emerge in recent times. Premiums for cyber risk are growing significantly, and daily headlines bring attention to yet another major data breach affecting an entity. Most of us with credit cards have probably had new cards issued because of a breach in the last year, and many of us have had health information compromised. Cyber Risk Throughout the course of 2015, I attended several cyber and security risk management, conferences in addition to doing extensive research on the topic. After reflecting on the information, I have compiled a summary of important actuarial issues related to cyber risk.

  • Credible industry data or unique company data does not exist for most companies to assess cyber risk using solely quantitative methods. Instead, the process of evaluating cyber risk should be holistic, involving both quantitative and qualitative assessments.
  • Limited industry benchmarking data does exist, however. Three example sources of data are the Ponemon Institute, The Verizon Data Breach Investigations Report, and the RIMS Cyber Survey.
  • The components of a cyber risk event could involve many expense items, such as litigation, public relations, investigations, privacy breach notifications, data restoration, regulatory penalties, loss of customers, and reputational risk.
  • Cyber risk is being added to some of the captives SIGMA works on. Our experience is that the risk is normally included in captives as deductible coverage or low limit coverage. Since policy types are almost always claims-made, year-end reserving is straightforward, if there is no reported or known claim as of the evaluation date.

As of May 2014, there will be a shift in language of GL policies to reflect a group of exclusions to prevent GL policies from covering cyber risk as proposed by ISO. This should increase the purchase of stand-alone cyber policies.

Cyber risk policies are difficult to compare due to an extreme lack of consistency in policy structure, language, exclusions, and coverage. Definitions of these may even vary considerably.

Cyber risk introduces broad and sweeping threats to a company. It truly is an enterprise risk and should be handled in a holistic fashion with multiple departments within a company or entity involved in managing the risk. Additionally, external experts from various disciplines should be considered for addition to a team evaluating the risk. Actuarial implications and analyses at this stage of emergence are difficult to define. However, as stand-alone policies continue to emerge, and as companies begin to include the risk in captive insurance companies, the need for analysis will become more important.

We welcome your feedback by posting a comment, or contacting Michelle Bradley at
© 2016 SIGMA Actuarial Consulting Group, Inc.

Leave a Reply

Your email address will not be published. Required fields are marked *


Recent Posts

Captive Solutions for Complex Risks in the Absence of Extensive Loss History
In a recent article published by Captive International, Sol Feinberg and Enoch Starnes discuss how the captive insurance space serves as an enticing option for entities faced with emerging or complex risks which often have limited amounts of historical data points. While this presents obstacles for ...
Read More
Navigating Premium Deficiency Reserves
SIGMA is pleased to announce the release of our newest educational resource, the Premium Deficiency Reserve Calculation sample. This resource provides an illustrative example of the calculation of a premium deficiency reserve (PDR). A company must record a PDR when the unearned premium of in-force b...
Read More
A Reflection on Data and Analytics for Captives
In a recent article published by Captive International, Michelle Bradley and Enoch Starnes discuss, “A Reflection on Data and Analytics for Captives". In it, they examine the business world’s reliance on data and analytics as decision-making tools, and how it has undoubtedly increased over the p...
Read More
Adapting Your Captive for a Shifting Risk Landscape
In a recent article published by Captive International, Michelle Bradley and Enoch Starnes discuss, “Adapting Your Captive for a Shifting Risk Landscape". In it, they examine how a company’s risk profile can shift dramatically and without any warning. The impact of a global pandemic, a rising ...
Read More

Subscribe to Our Blog

hello world!
Copyright © 2023 – 2024 SIGMA Actuarial Consulting Group, Inc. All Rights Reserved.
chevron-down linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram