A growing number of companies are turning to their captives to optimise their cyber insurance programmes and adapt to an evolving threat landscape, according to AXA XL’s Marine Charbonnier and Carlos Rodríguez Sanz.
Captive involvement in cyber insurance programmes has increased significantly in the past two years. At 色多多视频 we have seen enquiries from European clients exploring cyber captive insurance almost triple, while the number of programmes incorporating captive insurers has doubled in the past year alone.
Large companies are growingly mobilising their captives to support cyber insurance programmes amid tough conditions in the commercial cyber insurance market. The past two years have seen per risk capacity reduce and prices soar, as the cyber insurance market responded to more frequent and severe ransomware claims. Insurers have also increased deductibles and introduced new underwriting criteria, requiring a minimum standard of cyber security controls in a bid to improve risks and reduce losses.
Mitigating a challenging market
Captives can help alleviate the symptoms of a hard cyber insurance market. In particular, captives can provide capacity where market appetite is currently insufficient. In response to a rise in the frequency and severity of cyber claims, a number of insurers scaled back their participation in the market or moved to higher layers.
Involving a captive in a cyber insurance programme should give insurers in the programme additional confidence and help secure their support. Captive participation can also help manage the overall cost of cyber insurance, especially where they participate in primary and low-level excess layers, where capacity is more limited and where pricing is highest.
Following a period of adjustment, there are signs of stability returning to the cyber insurance market. However, underwriters remain conscious of the evolving cyber risk landscape and capacity remains tight, especially at lower programme levels. Where a captive is used to supplement market capacity, companies will need to be prepared and flexible if they are to respond quickly and fill gaps in a cyber insurance programme late in the placement.
Reflecting current capacity constraints in the cyber market, a group of European industrial companies recently established a new mutual cyber insurer. Belgium based MIRIS 色多多视频 will provide supplemental cyber capacity to European companies on a co-insurance basis from January 2023, following pricing and wording set by the primary insurer. 色多多视频is currently working with a number of clients looking to incorporate MIRIS capacity into their programmes.
Plugging coverage gaps
Some companies are also using their captives to address gaps in cyber coverage. On the whole, cyber insurance coverage remains broad. However, property and casualty insurers have reviewed contract wordings in recent years to address so-called silent cyber – also known as non-affirmative cover - removing or sub-limiting cover for cyber-related property damage, business interruption or bodily injury. Standalone cyber insurance also typically excludes property damage and bodily injury.
At the same time, the threat landscape continues to evolve, while growing reliance on digitisation and cloud services is leading to continued growth in business interruption and supply chain exposures. The conflict in Ukraine, meanwhile, has highlighted the risk of cyberattacks associated with nation states and terrorist groups, which raises complex issues around attribution, coverage and claims. Faced with complex and changing cyber exposures, captives can work with insurers to tailor cyber solutions to fit their specific needs and address any gaps in coverage.
Global cyber programmes
Captives can also be used to support multinational cyber insurance programmes, which have become more popular in recent years. As with other lines of business, global programmes facilitate centralised cyber insurance purchasing, claims administration and risk management for multi-national companies.
In addition to centralised oversight and administration, global cyber programmes can also provide local policies and claims administration in accordance with national insurance and tax regulations. Claims can be supported by local incident response services, such as specialist IT and legal consultants and crisis management teams.
Support and services
Cyber offers diversification benefits for a captive insurer, but it is a relatively new risk for the captive space. Captives will need to be comfortable enough with the risks they will be assuming and understand the potential impact on solvency and reserves. Ransomware claims, for example, have been increasing in frequency and severity, and the largest can impact the higher layers of a programme.
However, support is at hand. Working alongside insurers, captives can access a wide range of valuable cyber risk management and loss mitigation services. For example, AXA XL’s captive clients can access our cyber security scorecard, which enables real-time identification and containment of cyber vulnerabilities. They can also benefit from our cyber claims management expertise, as well as gain access to a comprehensive panel of third-party incident response consultants and services.
Strategic partnership
One of the biggest benefits of captive involvement in cyber is the opportunity to engage with insurers and take a more strategic approach to cyber. The challenges of digitisation and the constantly changing threat landscape make collaboration key to understanding and mitigating cyber risks. A strong client-insurer partnership will help align interests and facilitate the exchange of knowledge and information required to improve risks and prevent losses.
Collaboration is also essential for the development of innovative cyber risk management and risk transfer solutions. Supporting clients’ captives and global programmes is at the heart of AXA XL’s growth strategy, including supporting customers in the key area of cyber risk. We are committed to working with our clients as they capitalise on the benefits of digitisation, helping them understand and mitigate the risks, and as well as maintaining a sustainable cyber insurance market.
