Cyber: risk without borders Airmic 2016 Harrogate International Centre Tuesday 7 th June 2016

Moderator & panellists Nick Beecroft Manager, Emerging Risks & Research, Lloyd’s Hans Allnutt Partner, DAC Beachcroft Erica Constance Senior Vice President, Cyber, Paragon Insurance Brokers Mike Jacobs Business Continuity Manager, Dyson Laila Khudairi Underwriter, Enterprise Risk, Tokio Marine Kiln Graeme Newman Chief Innovation Officer, CFC Underwriting

UK Government 2015 Information Security Breaches Survey Businesses which suffered a security breach in the last 12 months Average cost of breaches PwC / Infosecurity Europe

UK Government 2015 Information Security Breaches Survey Impact of the most serious breachDo you have insurance which would cover you in the event of a breach? PwC / Infosecurity Europe 39 responses; % of respondents 212 responses; % of respondents No – but intend to purchase in the next 12 months No – was not aware it existed No – do not have the budget No – it is not a priority Yes – to prevent cost – cyber specific Yes – to prevent cost – included in other insurance Yes – following a breach – included in other insurance Yes – following a breach – cyber specific

Cyber insurance First Party cover Loss of or damage to digital assets Business interruption from unplanned network downtime Cyber extortion Reputational damage Theft of money and digital assets Physical damage Cyber risk management services Forensic costs Third Party cover Investigation, defence cost and civil damages associated with security breach or breach of privacy rights Investigation, defence cost, awards and fines resulting from an investigation or enforcement action by a regulator Investigation, defence cost and civil damages arising from defamation or breach of privacy from content on electronic media Legal, postage and advertising expenses where there is a requirement to notify individuals of a security or privacy breach Infringement of the intellectual property of a third party Loss of third party data

Cyber insurance at Lloyd’s 65 syndicates providing capacity in 2016 Approximately 20% of global cyber insurance written at Lloyd‘s Maximum single risk capacity ~£300m

Sources of uncertainty – challenges for innovation 52 ‘zero day’ exploits in 2015; 100% increase on % increase in spear phishing attacks Source: Symantec Internet Security Threat Report 2016 Human factors 81% of large UK businesses reported staff involvement in a breach 50% of the single worst security breaches caused by inadvertent human error Source: UK Government 2015 Information Security Breaches Survey

Sources of uncertainty – challenges for innovation Median number of days compromised before discovery/notification Intangible threats & exposures 416 days 205 days 146 days Source: Mandiant/FireEye M-Trends 2016: Special Report (February 2016)

Sources of uncertainty – challenges for innovation Cloud infrastructure services: global market share Systemic exposure Source: Synergy Research Group (April 2016) Lloyd’s exposure management policy Syndicate risk appetite Underwriting risk management framework Scenarios for solvency testing We are keen for Lloyd’s underwriters to continue to take a lead as a market with proven expertise and an ability to innovate. Lloyd’s also wishes to ensure that cyber-attack exposures are underwritten with appropriate controls in place.

Five Challenges 1.The impacts of a cyber security breach are complex and interconnected; cyber insurance is only relevant to a few of them 2.Insurers lack the data and expertise to charge an accurate risk- reflective premium 3.Cyber insurance products are immature and vary hugely between providers 4.Senior decision-makers do not understand the business case for purchasing cyber insurance 5.Large organisations require much greater limits of cover than insurers are willing or able to provide

Challenge 1 The impacts of a cyber security breach are complex and interconnected; cyber insurance is only relevant to a few of them

Challenge 2 Insurers lack the data and expertise to charge an accurate risk-reflective premium

Challenge 3 Cyber insurance products are immature and vary hugely between providers

Challenge 4 Senior decision-makers do not understand the business case for purchasing cyber insurance

Challenge 5 Large organisations require much greater limits of cover than insurers are willing or able to provide