Market debates ‘irresponsible’ pricing and near misses

By Michael Loney

March 21 - (The Insurer) - Soft pricing in the cyber market lies in contrast to increasing claims levels, according to speakers at a Professional Liability Underwriting Society conference, who also suggested that mini-catastrophe events are adding up to material losses.

Discussing market conditions at the PLUS Cyber Insurance Symposium in New York on March 4, Robert Parisi, head of cyber solutions for North America at Munich Re, said that “we're not pricing according to the risk” and “we're seeing pricing that is irresponsible”.

He added: “But I don't think pricing is the problem. I think coverage and more basic things are more important: having and adhering to a set of standards, a level threshold of confidence and resilience, making sure that we're dealing with the right attachment points the same way.”

At the same event, Tim Francis, enterprise cyber lead for Travelers, said “pricing has come down largely” while the claim trend has increased.

He described the increase in claims as “a little bit more of a slow bubble” as opposed to the large spike in ransomware claims seen a few years ago.

“Last year, we identified 55 new ransomware groups, so those are new bad guys trying to do bad things and trying to monetise activity,” Francis said. “You see social engineering events happening and increasing a little bit in severity as the technology gets more sophisticated.

"So when pricing is coming down and claims are going up, we find ourselves not just in a soft market sometimes but in a market where we're a little bit disproportionate to the exposures.”

Francis noted that even in some cases where pricing is staying flat the rate has decreased because the insured’s revenues have increased.

“So as an underwriter, we're thinking about making sure that we have the right price for the exposures of that customer, and that's a challenge in a market in which pricing has come down,” he said.

Anthony Dolce, head of professional liability and cyber at The Hartford, agreed that “we’re still in the middle of the soft market”, with abundant capacity.

“It's more of a buyer's market,” he said.

When asked whether the market needs a big systemic event to turn, Dolce noted there were a handful of larger events last year that did not have an impact.

“I think it's just one of those things where the market is the market, and it's going to be cyclical and when attritional losses from claims and some of the larger events reach a certain point that will eventually impact the market and move it a little bit,” he said.

Dolce added that it is “a very uncertain environment, whether from a regulatory standpoint or from a geopolitical standpoint”.

Travelers’ Francis suggested that carriers have to make sure that they are not just pricing products to the exposure but making sure they are providing customers access to risk control services and services “that actually matter to the customers’ ability to better their environment”.

“There’s getting to be a point where you've got to be more precise,” he said. “In some risks, there's still an opportunity I think for pricing to come down. But there are some risks that their pricing needs to come up or their limits need to come down because their exposures just aren't there or they need to get better cybersecurity hygiene to keep that price.”

IS THE MARKET LUCKY WITH NEAR MISSES?

Moderating one of the sessions at the symposium, Tracie Grella, global head of cyber risk insurance at AIG, suggested the market has learned a lot from the near misses.

“I don't know how many there’s been. I know we're tracking probably 70 or so (cyber events) at AIG, so there is quite a lot to learn from,” she said.

In the same session, Munich Re’s Parisi expressed discomfort with the concept of near misses. “I think that's been luck, not necessarily constructive or proactive underwriting,” he said.

Parisi continued: “I think the problem is the markets are not necessarily choosing to be responsive to the fact that this is an ever-changing environment. The soft market is driven by the fact that people are jumping in for fear of missing out. They're continuing to broaden coverage after a 20 year slide of making it broader and charging less for it.”

He added: “It’s a dangerous model to think, ‘Hey, our environment is changing, it's getting worse, what should we do? Well, let's give more coverage and charge less for it.’”

Richard DePiero, EVP and head of Sompo Pro, pushed back on those who believe it is just luck that events such as the CrowdStrike outage were not worse.

“I think CrowdStrike is a near miss and I think to categorise it as lucky is maybe mostly right, but I want to give ourselves a little credit,” he said. "Post the hard market you saw waiting periods come up from where you (previously) saw them dipping down to six hours.”

DePiero added that he does not think the market always gets the benefit in modelling from the policy protections that are in place.

Munich Re’s Parisi suggested that it is a “two-tier, two-class market” split between the large risks and the SME space.

“The large risk I would view as less about systemic risk and more about catastrophic. They're big and they’re targets; if something hits them, there's going to be a big issue,” he said.

In contrast, the SME space is heavily reliant upon vendors, and buyers do not have an office of the CISO.

“If something happens to one of them, the chance is it is going to happen to others. They're more likely to be interconnected with other small people, so it will have a knock-on effect,” Parisi said.

Parisi suggested that large accounts tend to be more resilient. He pointed to the CrowdStrike outage, which he said could have easily been catastrophic and systemic for small companies because the problem was the automatic update.

But the losses were not as large as they could have been because CrowdStrike generally has a large company client base that does not accept automatic updates.

PAPER CUTS ADDING UP

DePiero at Sompo warned that the events the cyber market is seeing now, while not by themselves market changing, could have a combined material impact. He pointed to CrowdStrike, CDK, Change Healthcare, Snowflake as well as the Meta Pixel losses.

“By themselves they're not changing the world, although I would talk about Pixel losses being a lot worse than anybody has really talked about,” he said.

“By themselves we don't see them as catastrophic incidents. But together I think they're enough to exceed some people's capital and get into the attritional loss. Those are the losses that combined just really aren't talked about, and they're going to materially impact markets, especially if you're over concentrated and not diversified in some industries.”

DePiero said that the Meta Pixel exposure hit the healthcare industry first but has extended to “anybody that has a website now”.

“So by itself, each one it's a paper cut. But those paper cuts add up, and they're adding materially to the loss ratio,” he said.

Munich Re’s Parisi commented that he does not want to see a catastrophic event for the market but said “the market’s not learning from these teachable moments of near misses”.

“So what's going to teach the market that this is potentially a very dangerous and volatile coverage? Why is a large portion of the market not understanding that this is a volatile product?” he asked.

SOME IMPROVEMENTS NEEDED

Parisi also suggested that the market has got into some bad habits that it needs to correct.

“It took us a while during the hard market to correct what was a long term slide down. If you weren't just broadening coverage, you're also dropping retention,” he said.

Parisi added “enough with the drop downs on the most problematic coverages”. He said this is fine for the primary layer but is problematic for excess layers, “and we all agree it is the worst coverage”.

“So there are a lot of things we're doing that we did early on when cyber was still maturing that we need to stop,” he said.

Nadia Hoyte, cyber practice leader at USI Insurance Services, suggested that the market also needs to do a better job of communicating about data to policyholders.

“The entire industry has to do a better job of sharing relevant data,” she said.

Hoyte continued: “I don't think that policyholders always get that information about what they could have done better in a consistent way. I think that some of that information resides with incident response vendors, and it may not even be given in manageable, digestible spots to insurers as well.

“So I do think that we have to do a better job about sharing data and understanding the rope that forms the data that needs to be shared.”