Global insurance market report [gimar]

 
Insurer experience data
»
 
Counterfactual risk assessment
»
 
Third-party cyber-risk models
»
 
Worst-case scenario analysis
»
 
Compliance with cyber-security standards.
Four main approaches have been used in the 
past,
31
but an overall lack of harmonisation 
creates wide variations in 
pricing and product offerings. 
Insurers may quote differently 
for the same type of risk, 
depending on what they define 
as a cyber-risk, cyber-incident 
or cyber-attack, and this 
determination will be based 
on a variety of available data 
sets and other underlying 
information used to price the 
risk coverage.
Questions remain about 
the reliability of traditional 
cyber-models as very few 
insurers have the capability 
to accurately measure cyber-
risk. The Geneva Association has noted that 
property catastrophe modelling took between 
25 and 30 years to mature,
32
and that modelling 
was based on a risk that had a clear geographic 
footprint and extensive experience data. In 
addition, accurately measuring cyber-risks 
involves several challenges: given that this risk 
has only recently developed, experience data is 
limited; the occurrence of an event relies on the 
unpredictability of human nature; and the severity 
of the loss depends on a nearly endless number 
of variables that occur in a highly connected 
digital environment.
As the industry continues to develop advanced 
modelling techniques to account for these 
factors, deterministic scenario-based methods 
have provided a working solution in the interim. 
Some modelling vendors are developing 
dedicated cyber-risk models, with several creating 
predictive models that seek to specifically quantify 
non-affirmative risk. All cyber-models must be 
continuously developed on an iterative basis in 
response to the dynamic nature of cyber-risk.
Insurers and modellers can examine previous 
cyber-events (and near misses) using 
counterfactual analysis to identify potential worst-
case scenarios and calculate maximum
probable exposure levels. Insurers, particularly 
new entrants to the cyber-insurance market,
also rely on knowledge gained from modelling 
and underwriting in established categories,