Industry Panel Highlights Challenges in Selling Cyber Insurance to SMEs

Small- and mid-sized businesses hear and read the same news everyone else does. Awareness of cyber risk isn’t the problem. But after years of insurers market trying to crack this nut, these businesses aren’t buying the right coverage.

The disconnect became the focus of a recent industry panel at NetDiligence’s Cyber Risk Summit in Philadelphia earlier this month as experts contemplated growth opportunities for cyber insurance, which still accounts for just a very small portion of overall property/casualty premiums.

Raising awareness does not necessarily equal demand for the product. The problem appears to be getting businesses to understand what they’re buying – and getting insurance agents comfortable selling it.

Erin Burns, director of the cyber practice at CRC Group, said many retail agents serving smaller businesses simply aren’t equipped to comfortably discuss cyber to help clients imagine the consequences of a network system failure or attack.

“From an insurance perspective, we need to fill the gap between awareness and action,” Burns said. However, right now, businesses do not understand the problem or the benefits of a cyber insurance product because the seller can’t present it an effective way, she said, adding that there is only a “small number of brokers that actually have dedicated experts within the organization.”

“Even the ones that [have cyber experts], a lot of times they allow their generalists to handle the whole process. The generalist isn’t comfortable talking about it,” Burns said.

The result makes her “cringe,” Burns said. Businesses are falling back on lackluster coverage.

Jamie Schibuck, head of cyber and professional liability Open Brokerage at Arch Insurance, said lately cyber growth can be attributed to a lot of endorsements. Therefore, the penetration into the SME space is with a “watered down product,” he said.

“There’s a bit of a trade off in terms of…we can get this product out to a lot more people because it’s cheap and it’s just bolted on,” Schibuck said. “But then it’s like what are we really giving them?”

This can leave a bad taste in the mouth of a policyholder who turns to the product when something happens only to find it isn’t as robust as standalone cyber insurance.

The solution might be simpler products with standard terminology that respond faster.

‘”There’s definitely some opportunities to make the product more sellable, straightforward, clearer,” Schibuck said. “I think part of it is better explanations of the existing products. There probably are some opportunities with the existing product to make it more straightforward, particularly with regard to business interruption.”

He offered the idea of a parametric-type of approach so smaller businesses do not have to wait weeks or months to be a reimbursement, because that kind of time may not be quick enough to keep them afloat.

The issues involved in insuring cyber risk can get complex, but Dan Truman, CEO of managing general agency Nostos, said he believes there is a way to “democratize some of the information, and to break it down into smaller steps to be able to persuade people more clearly.”

“We work within a broader ecosystem. I think within that ecosystem, we’ve got to work together more effectively to break some of these things down to less complex steps and be able to explain it,” he said.

The industry has attracted traditional and alternative capital to cyber insurance, by way of traditional reinsurance the panel suggested that money isn’t the principal obstacle anymore.

Damini Mago, head of cyber ILS at Marsh Re, said substantial traditional reinsurance and insurance-linked securities capital is available, so growth is less about that fear and more about demand. The bigger question is how to turn the capacity into meaningful protection.

Growth is potentially substantial, particularly among smaller businesses and outside the United States. But panelists cautioned against assuming increased cyber threats will automatically produce increased insurance purchases.

As Arch’s Schibuck put it, insurers need to “stop assuming that we’re going to grow because the risk is growing.”