This figure could include one or more events within the same year. The 1-in-200 year industry event was only slightly more impactful at $16.1bn. At 92%, the vast majority share of the losses came from business interruption (see fig 2).

Extreme worst-case single loss scenarios at much lower probabilities ranged from an insurance bill of $11.5bn from a large-scale cloud ransomware at a leading cloud services provider to a widespread data loss from failures in a leading operating system, causing a $23.8bn insured loss at a 300-plus year return period.

For mature markets the modelled losses do not appear to be hugely out of kilter with the base premium and the current industry income should be able to fund its cat costs. This may not be the case everywhere.

“Even though it is in its infancy, the challenge with modelling is whether it will ever be effective. You can underwrite and model for adequate systems and processes, however this is not an indiscriminate risk like the weather.  We are seeing targets handpicked across all manner of industry sectors in circumstances where the risk profile can change overnight as new vulnerabilities are exploited and attack vectors shift”, says Kieran Doyle, Partner with Wotton + Kearney in Sydney.

“While overseas markets are becoming more mature, the Australian cyber market is still in its infancy meaning that a few significant losses in a single year would likely threaten the Australian market’s entire premium pool”, warns Doyle.

Mismatch 1: War or no war?

But in the real world would this represent the true picture? How many of these billions would be in dispute? How might war exclusions come into play?

As Oliver Brew, Head of Client Services at CyberCube explains, a huge question mark still arises over coverage for acts of war:

“We chose to park the hotly contentious debate as to whether a cyber war exclusion may impact the recoverable losses… Attribution for cyber events is notoriously difficult either because of obfuscation by the protagonists, or simply the threshold between a kind of malicious cyber event and what is then categorised as an event of cyber war.”

Hans Allnutt, Partner and Head of Cyber and Data Risk at DAC Beachcroft in London backs up the view: “There is not so much a gap, but there is a lack of certainty as to whether cyber activities amount to war” he explains.

In America, there is a keen debate around the extent that the Terrorism Risk Insurance Act (TRIA) extends to possible state-sponsored cyber attacks.

“There are still a number of unanswered questions concerning TRIA, and the US Government Accountability Office has been directed by Congress to address these issues.  As noted by the American Academy of Actuaries, given the nature of cyber attacks, it is often difficult to pinpoint the exact source, timing and motivation of threat actors.  As such, there is a strong desire for specific guidance as to which types of attacks are considered terrorism, and the relevance of the involvement of foreign governments in determining whether an act is considered terrorism or ‘war’ for purposes of coverage under TRIA,” says Anjai Das, Partner with Wilson Elser in Chicago.

This is far from an exclusively UK or US problem, says Dr Franz König, Partner at BLD Bach Langheid Dallmayr in Cologne.

“War is used in the context of inter-state conflicts in many German insurance contracts. So, it is totally unclear what a ‘cyber war’ is. The criteria used for traditional warfare is insufficient. ‘Cyber-terrorism’ faces the same problems. We need to form new, cyber-oriented exclusions for these phenomena.”

Graeme Newman, Chief Innovation Officer at leading cyber managing general agent CFC Underwriting, is clear that war exclusions are written into all policies.

The war exclusion is a very broad one. Newman says that if there was a event and a nation state was looking to cause mass destruction through cyber, this would be a loss “that market could not bear”.

The only solution would be state-backed schemes in the mould of the UK’s Pool Re terrorism , added Newman.

However, Newman explains that in marked contrast to overt war, the market is prepared to give coverage to such difficult-to-prove war-like acts.

“The real problem is criminal gangs operating with state sponsorship and committing large mass malware campaigns – this is covered by the market right now and seemingly there is appetite from within the reinsurance market to give ongoing coverage for that.”

However dispute-hunters can readily appreciate that if the act were systemic and damaging enough, the temptation or the necessity to litigate the war exclusion is there for all to .

Mismatch 2: Broad utilities exclusions

It is not uncommon for cyber insurance policies to include major systemic risk exclusions inserted by their cyber insurer. Events such as power utilities going offline or a catastrophic failure of the internet and satellite communications systems are not covered.

The loss potential from all these scenarios is vast. Equally huge is the potential for the insurance industry to find itself in a reputational position similar to during the global COVID-19 pandemic over business interruption cover for small businesses.

“Imagine those big, big systemic events. They are largely excluded and that might be another area where customers would have a shock when that event happens,” Newman explains.

“That’s likely to be the big dispute and one that can only be solved with some kind of specialist backstop solution.”

Hans Allnutt agrees and adds a strong observation about the increasingly ubiquitous cloud providers such as Amazon Web Services:

“Cloud providers are effectively becoming a utility so you could say ‘what happens if the internet goes down?’ but the insurers will typically exclude utilities such as electricity for that reason.

“Cloud providers are in that grey zone of almost becoming a utility – potentially uninsurable, but from a policyholder perspective that’s the sort of thing you want cover for.”

Currently a competitive market makes excluding exposure to big cloud providers impossible, but grey zones abound. Some markets are working towards new exclusions but the solutions are far from clear, says König.

“In some new cyber wordings special exclusions were placed for ‘business interruption as a consequence of loss of service by a cloud-service-provider’. But that’s not market standard and there are no specialised clauses with regard to big systemic events.”

Any failure to grasp the implications of how greater reliance on cloud services and the complex interdependencies could cost insurers dear, warns Ian Stewart, Partner with Wilson Elser in Los Angeles.

“The coronavirus pandemic has caused businesses in almost every industry sector to greatly increase their reliance on technology and infrastructure. This dependence on technology has resulted in an increased operational risk alongside insurance cover that has often not kept pace. Network systems have problems and computers fail. Though most companies can find adequate cyber coverage for routine systems failures, growing reliance on cloud service providers is making it more difficult to determine whether an occurrence is an insurable failure of the insured’s computer system or an uninsurable infrastructure failure. Unless the insurance market begins to adjust to this new reality, carriers may find themselves on the wrong end of future US court judgments.”

Mismatch 3: Small managed service providers and outsized blow-out losses

The third mismatch comes in the form of a genuine underwriting shock which may catch many carriers unaware.

A very big and potentially unexpected loss occurs like this:

While underwriters are busy worrying about a major outage at a mega Amazon, Microsoft or Google cloud platform, hackers are busy worming their way into much smaller managed service providers (MSPs).

Perhaps it is a payroll or accounts provider or a niche player that has specialist services tailored to a particular sector.

It may be relatively small in the grand scheme of things but it might have tens of thousands of customers. If a hack destroyed data at 10,000 of its clients, at $1m apiece that is a $10bn single risk loss. And quite possibly that one loss could be with a single insurer, exceeding its reinsurance protections and possibly imperilling the carrier itself.

Newman points out that such losses are wholly plausible and indeed likely to be relatively frequent: “If I were in Lloyd’s that would be the event I would be more worried about… Put your return period on that, but I tell you it’s not 1-in-250, that’s for sure."

Allnutt cites the recent example of a ransomware attack at service provider Blackbaud. This firm had cornered the market in supplying cloud based services to not-for-profits and education, managing assets like donor and alumni databases for notable universities and charities.

“This one attack on Blackbaud has trickled down into hundreds of notifications and claims,” Allnutt advises.

Luckily it appears data was not destroyed in the Blackbaud case, so most of the loss will centre on breach notification expenses, but the warning signs for the industry are clearly there (see Box below).

A shock loss leading to insolvency can only mean lots of litigation.

Mismatch 4: Privacy – a new exclusion?

One last possible mismatch is the increasingly vexed area of privacy.

Hans Allnutt explains that cyber insurance has always historically been sold as cyber and privacy insurance.

As major economies have regulated and new rules such as GDPR have developed, claims over the way data handlers behave and customer data is exploited have also begun to develop.

“A few years ago the case law on how to claim, and how much could be claimed, was pretty undefined. However, the number of claims are now significantly coming through” he explains, noting that most of these losses do not relate to cyber security breaches.

He notes that while multiple compensation claims may be individually small, they are numerous and the legal fees associated with each are multiples of the actual compensatory sums. This could be storing up trouble for the future if underwriters are forced to remove a cover that has been traditionally expected by insureds.

“As the exposures go up, insurers may row back on the extent of cover, in which case people are going to find themselves uncovered for certain cyber events and certain privacy violations.”

“…That’s where the disputes will be – where people previously thought they were covered and they are not,” Allnutt warns.

In conclusion cyber is a young and immature class whose covers are evolving and are yet to be tested. (see Box below).

The above quartet shows the class brims with the possibility for forcible and potentially very costly accelerations into maturity. Many other as yet unidentified mismatches are undoubtedly lurking.

Let us hope this high flyer can reach a mature state without having to learn any expensive lessons.

The above quartet shows the class brims with the possibility for forcible and potentially very costly accelerations into maturity. Many other as yet unidentified mismatches are undoubtedly lurking.

Let us hope this high flyer can reach a mature state without having to learn any expensive lessons.