Cyber Risk and Cyber Insurance Anna Maria D’Hulster, Secretary General IAIS Global Seminar 16 June 2016, Budapest

The Geneva Association research on cyber risk and cyber risk insurance with the university of St Gallen 2 Purpose of the study is to provide an overview on the main research topics in the emerging field of cyber risk and cyber risk insurance The study illustrates the current difficulties of insuring cyber riskThe study also discusses various ways to overcome the current hurdles to insurability Study will be published by the end of the Summer: today’s remarks are based on our insights as at the end of May, 2016 Source: GA

A three step methodology for the study 3 1. A review on ‘Cyber Risk’ and ‘Cyber Risk Insurance’ using a standardised search 2. Discussion of review results with experts from GA member companies Source: GA 3. Setup of a database to extract the main research results

Descriptive statistics of the 201 studies reviewed 4 Source: GA

5 1.What is cyber risk? Definition and categorization 2.What are costs and detrimental effects caused by cyber risk 3.Where do we find data on cyber risk? 4.How can we model cyber risk? 5.Micro-perspective: How should cyber risk management be organized? 6.Macro- perspective: is there a threat to the global economy? 7.Cyber insurance market: what is the status and what are the main challenges? 8.What can the industry do to prevent cyber risk and support cyber insurance? 9.What can the government do to prevent cyber risk and to support cyber insurance? 10.Future research directions on cyber risk and cyber insurance… We structured our research along 10 questions

Q1: What is Cyber Risk ? Definition and categorisation 6 Any risk form the use of IT systems that affects the confidentiality, availability or integrity of information (systems) caused by (non) criminal activity Cyber Risk is characterized by - interdependencies, - potential extreme events, - high uncertainty with respect to data and modelling approach… - and risk of change Source: GA

Q3: Where can one find data on cyber risks ? 7 Scarce, because of reluctance to report occurrences by the ‘victims’Most empirical research is based on data breach information (not loss information) Source: GA

Q5: Micro-perspective: How should cyber risk management be organized ? 8 In each of the 5 steps of the risk management there are special features for cyber risk… Standard tools and instruments should not be used Institutional commitment Effective crisis management Risk communication with stakeholders Continuous monitoring => Focus on mitigation Source: GA

Q8: What can the insurance industry do to prevent cyber risks and to support cyber insurance ? 9 A)To prevent cyber risks: (1)develop standards (2)common language and good practices (3)scenario analysis (4)dialogue with stakeholders (5)follow-up on technological development (6)further develop analytical and modelling skills (7)secure own systems B) To support cyber insurance: (1) develop anonymized data pool (2) develop (re)insurance pool (3) analyse existing policies (4) develop new adequate products/policies Source: GA