Cyber is an expanding net growth area with the opportunity to offer a compelling insurance offering, particularly in the mid-market segment. But the path to becoming a market-leading and profitable cyber insurer is full of challenges. In this article, we outline the essential strategies for developing a best-in-class cyber offering, culminating in a guide to the seven strategic cyber moves for the Chief Underwriting Officer.
Why cyber has unique challenges to overcome in medium-sized businesses
The cyber risk landscape is evolving so quickly that insurers need a robust framework to, for example, enable continuous data-driven learning from previous claims, provide a seamless quoting and retention process, and mitigate unintentional risk aggregation.
While the SMB market typically purchases standard cyber protection directly and online, the mid-market consists of companies served by brokers and agents. These companies require insurers to have both basic and advanced skills to effectively address the unique challenges of cyber risk in the mid-market. The key challenges that make cyber unique in the mid-sized market are as follows:
Transparency and clarity for brokers and agents: Since the middle market is predominantly served by brokers and agents, it is crucial that the insurer’s risk appetite and underwriting approach is transparent. Whether the insurer offers its own cyber broker portal or As the company leverages existing portals across multiple business lines, the key is to have transparent risk appetite and allow brokers to seamlessly compare offers and place deals. Additionally, receiving accurate quotes on the same day is essential.
Need for standard and customized policies: The middle market consists of companies that purchase both standard and customized policies. Insurers therefore need to be able to quickly implement changes to policy conditions, changes to exclusions or some other mix of higher deductibles or floors. Some medium-sized companies have demanding requirements for risk mitigation, prevention and incident response planning. For large, medium-sized customers, an in-depth risk analysis may be necessary to design the right insurance coverage.
Significant amounts of data: While a standard cyber policy requires no more than four data points from an SMB customer (customer name, industry, revenue, and website), midsize customers require far more data points. Some data points can be accessed through open APIs and structured data ingestion from brokers. However, the more complex the risk, the higher the likelihood that the relevant data points will arrive in unstructured documents.
Building a robust digital infrastructure for cyber insurance
Cyber insurers need basic sales, quoting and retention skills to ensure a smooth business process. The operating model begins and ends with a focus on the customer and broker experience. Whether insurers organize themselves according to the customer segment (e.g. a medium-sized company). center (of Excellence serving all lines of business) or depending on the line of business (e.g. a dedicated one-stop-shop cyber team for sales, underwriting and claims), it is important that this is a conscious decision at the C-level.
All customers, regardless of whether they purchase cyber insurance, should quantify their cyber risk and define their key cyber risk scenarios as part of their incident response planning. If they fail to do so, they incur unknown and potentially significant accounting risk. Some insurers may choose to invest in risk scenario capabilities, while others may rely on brokers or outsource to cybersecurity experts. The capabilities required for a detailed threat analysis are similar to those that some insurers offer in a cyber saferoom, which provides a safe space for pre-incident consultation and training, cyber stress testing, cybersecurity readiness assessment tools, detection and response solutions, incident response planning, notification services and embedded claims services.
An important fundamental skill for cyber is a strong digital core and needs-based master data management. Insurers need strategic tools such as a robust digital core and fit-for-purpose master data management to conduct detailed risk analysis at the quoting stage. These tools facilitate granular risk accumulation and provide a framework for measuring and understanding aggregate cyber risk exposure based on various parameters, including industry, underlying hardware and software, cybersecurity maturity, supply chains, jurisdiction and company size. A detailed risk management framework is critical to effectively mitigate the risk of inadvertent risk aggregation.
Building advanced, market-leading cyber capabilities
A critical component of becoming a market-leading cyber insurer is that technology and data capabilities must be designed to work at scale and in real time. Cyber insurance is one of the most challenging sectors due to the potentially catastrophic and limitless nature of breaches. Cyber incidents can be constantly evolving and unpredictable, similar to oil spills, and can have serious impacts on businesses, societies and critical infrastructure such as hospitals, water and wastewater systems and airports. Today, the threat of inadvertent risk pooling is a clear and present threat to insurers.
As mentioned above, significantly more data points need to be collected and modeled during the quote and lock-in phase for cyber policies for medium-sized businesses. Additionally, there can be hundreds of relevant data points in the initial claim report, which is far more than, for example, a motor vehicle claim where insurers typically collect 20 to 30 engine-specific data points (vehicle details, intended use, witness details, IoT data, etc.). For a cyber claim, there are more than 100 data points that can be relevant for continuous learning and refinement the risk management, the actuarial tables and the risk controls in the underwriting system. This, in turn, enables a market-leading insurer to remain profitable through a robust risk appetite and pricing framework.
As previously There is a shortage of cyber talent with in-depth knowledge of cybersecurity protocols and a deep understanding of ever-evolving regulations and laws in IT, AI, GDPR and consumer protection. While investing in talent and continually upskilling insurers and claims adjusters, there are wide-ranging use cases for AI and Gen AI solutions in cyber insurance. We’ve seen AI and Generational AI save underwriters dozens of hours per month and allow them to spend their time doing just that Niche and hazardous areas that require extensive human expertise.
Insurers with a strong digital core can rapidly accelerate their profitable growth in cyber, but most insurers are increasingly recognizing the investment required to implement AI and genetic AI at scale. According to AccenturePulse of Change Research46% of insurance C-level executives say it will take more than six months to scale Gen AI technologies and realize the potential benefits. If applications and data are not in the cloud and a strong security layer is not in place, it is virtually impossible to benefit from Gen AI at scale.
The 7 Strategic Cyber Steps for the Chief Underwriting Officer
In today’s rapidly evolving technology landscape, chief underwriting officers face the critical task of navigating their organizations through the complexities of cyber insurance. The following strategic steps are a guide for insurers to not only survive but thrive in this challenging environment:
- Define your identity in cyber insurance: Decide whether you want to be a conservative insurer, a fast follower or a market leader. This choice will guide your investments and highlight cyber as a core part of your business.
- Found Your cyber brand: Determine your standout cyber insurance offering, whether it’s best-in-class risk advice, competitive pricing, AI-powered and optimized processes, or a strong reputation in claims services.
- Choose a specialization: Choose between establishing a dedicated mid-market Center of Excellence (CoE), a cyber-specific CoE, or a hybrid operating model.
- Improve responsiveness: Transform or implement new features to deliver accurate quotes in hours.
- Refine Underwriting Practices: Decide on the optimal number of underwriting variables for technical pricing. Reengineer your processes to capture important data at the broker submission and claims stages.
- Assess Cyber Exposure Management: Engage external experts to assess your cyber exposure management to help avoid unintentional risk aggregation.
- Invest in talent: Focus on a talent strategy that enhances skills and integrates advanced technologies such as AI and Gen AI to keep pace with the evolving cyber risk landscape.
Measuring your path to becoming a cyber market leader
Designing and executing a leading cyber insurance framework presents significant challenges. A critical aspect is defining success, establishing metrics, and determining the actions necessary to achieve these goals. Continuous monitoring of financial and operational metrics is essential for making timely adjustments and ensuring profitable growth in cyber SMEs. For further discussion please contact Carmina Lees And Matthew Madsen.
