International Association of Insurance Supervisors, Budapest, 16 June 2016 Cyber insurance Consumer needs and modelling challenges Domenico del Re, Director, Actuarial Services services

PwC Cyber risk A consumer centric view The insurance industry is still at periphery of the value chain Cyber insurance 2 June 2016 Companies and individuals are gaining an increased awareness of their exposure to cyber risk; driven by the increasing costs of breaches, the proliferation of personal and private data and regulatory and rating implications being the major drivers. AssessImproveProtectMaintainRecoverDetect Understand current cyber exposure and gaps or flaws in protection. What is my possible maximum loss ? What investment will give me the best protection? How insurers recognise the investment? What protection can insurance give me to risks I cannot manage? What financial safety will insurance give me? What is my exposure to new threats? Who will alert me to new cyber risks to my business? How will I know I am breached ? How do I get rapid access to forensic analysis? What services will I need to get back to business? What financial support will I get? Limited linkages between investment and risk mitigation. Current cyber policies not optimised for the ‘Internet of things’. Proliferation of ‘connected’ devices will rapidly increase exposure and contagion risks. Some policies are bundled with forensic services to understand breaches and feed in to detection activities. Consumer- view of the cyber risk Current status of insurance industry 1) “2015 Global Cyber Impact Report” - Aon Risk Services & Ponemon 25% Only 25% of policies cover revenue losses 1 Accumulation risk poorly understood. Too few precedents for traditional actuarial approaches. Policies are not perceived to be value for money, and for the covers sought A wide range of approaches and metric to assess vulnerability; still challenged to find link between the assets, defences and loss potential. Uncertainty over exposure to “silent” cyber in existing policies. In some territories insurers are covering the cost of recover activities, e.g. PR or legal fees.

PwC AssessImproveProtectMaintainRecoverDetect Cyber Insurance – A blueprint to respond to customer needs Cyber insurance 3 June 2016 Through a combination of front and back office activities there is a real opportunity for the insurance industry to become an end to end solution provider. Alignment with existing industry standards or creating standards that can be used in insurance risk assessment. Relevant questionnaires. Quantify benefit of investments to the risk protection Reduce universe of risk. Develop a mutually trusting relationship between insurer and client. Design policies that are value for money, reflect the underlying assets and security posture, can be relied on by companies. Cyber cover as an effective component of a cyber-risk management strategy - help understand and mitigate cyber threats specific to the enterprise.. Policies to offer resources with designated tasks for managing breach response activities and forensic investigations. Support client through the cyber event with crisis management, communications, and legal advice. Comprehensive underwriting approach Focuses on sectors and risks that are understood Is aligned with risk appetite and ORSA Alliances with cyber specialists Can perform technical assessments and advise client cyber risk management. Build crisis training capabilities and prepare claims for systemic market event. Selection and pricing Risk and capital assessments performed. Develop scenario testing and aggregation frameworks. Provide tailored and value for money cover. Threat intelligent and data grabbing Similar to flood, insurance companies alert of cyber threats to prevent losses. Through data acquisition /augmentation gain an awareness of cyber incident history to foresee areas of weaknesses. Portfolio management -Data completeness and augmentation -Exposure management framework -Existing book “silent” portfolios -Scenarios bespoke to cyber exposure Front office will liaise directly with the client and provide value adding service Back office activities will help to understand and quantify the risk. Monitoring exposure to create a feedback loop on pricing and profitability Own cyber security To be a trusted partner and hold more client data insurers need to be able to demonstrate the highest levels of cyber diligence.

PwC Cyber insurance market – what next ? 4 Where is cyber insurance heading 90% 0f the market is US exposure, new data protection regulations (GDPR) will increase the demand globally Cyber is a growth opportunity requiring initial investment – the industry needs to act now as the market is ripe for disruptors The industry will need to get close to the detail. Expect to see increasing multi- disciplinary efforts: product developers, risk modellers, legal experts all need to forge links with the cyber security community. What should the supervisory community be preparing for Demand for cyber risk quantification is high; new approaches and products are entering the market; maturity is low and there will remain a large amount of uncertainty. Poor loss data means expert judgment from specialist will underlie many of the cyber catastrophe scenarios. Solvency II and other risk-based capital regimes will guide companies put a framework and transparency in the risk management assumptions. Knowledge sharing and proportional regulatory intervention will support sector to mature Availability of cyber insurance coverage is required to protect investments in new connectivity technologies Current market size: ~$2.5bn Predicted growth: PwC - $7.5bn by Allianz - $20bn by June 2016 Cyber insurance

This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers LLP, its members, employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. © 2016 PricewaterhouseCoopers LLP. All rights reserved. In this document, "PwC" refers to the UK member firm, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see for further details NB-OS Q&A