Tag Archives: Underwriting

Bridging the Cyber Insurance Data Gap

 

 

Cyber risks are opportunistic and indiscriminate, exploiting random system flaws and lapses in human judgment.

Underwriting cyberrisk is beyond difficult. It’s a newer peril, and the nature of the threat is constantly changing – one day, the biggest worry is identity theft or compromise of personal data. Then, suddenly it seems, everyone is concerned about ransomware bringing their businesses to a standstill.

Now it’s cryptojacking and voice hacking – and all I feel confident saying about the next new risk is that it will be scarier in its own way than everything that has come before.

This is because, unlike most insured risks, these threats are designed. They’re intentional, unconstrained by geography or cost. They’re opportunistic and indiscriminate, exploiting random system flaws and lapses in human judgment.  Cheap to develop and deploy, they adapt quickly to our efforts to defend ourselves.

“The nature of cyberwarfare is that it is asymmetric,” wrote Tarah Wheeler last year in a chillingly titled Foreign Policy article, In Cyber Wars, There Are No Rules.  “Single combatants can find and exploit small holes in the massive defenses of countries and country-sized companies. It won’t be cutting-edge cyberattacks that cause the much-feared cyber-Pearl Harbor in the United States or elsewhere. Instead, it will likely be mundane strikes against industrial control systems, transportation networks, and health care providers — because their infrastructure is out of date, poorly maintained, ill-understood, and often unpatchable.”

This is the world the cyber underwriter inhabits – the rare business case in which a military analogy isn’t hyperbole.

We all need data — you share first

In an asymmetric scenario – where the enemy could as easily be a government operative as a teenager in his parents’ basement – the primary challenge is to have enough data of sufficiently high quality to understand the threat you face. Catastrophe-modeling firm AIR aptly described the problem cyber insurers face in a 2017 paper that still rings true:

“Before a contract is signed, there is a delicate balance between collecting enough appropriate information on the potential insured’s risk profile and requesting too much information about cyber vulnerabilities that the insured is unwilling or unable to divulge…. Unlike property risk, there is still no standard set of exposure data that is collected at the point of underwriting.”

Everyone wants more, better data; no one wants to be the first to share it.

As a result, the AIR paper continues, “cyber underwriting and pricing today tend to be more art than science, relying on many subjective measures to differentiate risk.”

Anonymity is an incentive

To help bridge this data gap, Verisk – parent of both AIR and insurance data and analytics provider ISOyesterday announced the launch of Verisk Cyber Data Exchange.  Participating insurers contribute their data to the exchange, which ISO manages – aggregating, summarizing, and developing business intelligence that it provides to those companies via interactive dashboards.

Anonymity is designed into the exchange, Verisk says, with all data aggregated so it can’t be traced back to a specific insurer.  The hope is that, by creating an incentive for cyber insurers to share data, Verisk can provide insights that will help them quantify this evolving risk for strategic, model calibration, and underwriting purposes.

Fairness In Auto Insurance

Insurance Information Institute (I.I.I.) chief actuary James Lynch offers some perspective on underwriting and auto insurance pricing.

The journalist was working a story on how insurers vary rates in some surprising ways. Over the past few days, industry skeptics have questioned how insurers could have the audacity to charge widows more than married couples, and they have questioned whether drivers with poor credit histories should pay a higher surcharge than a driver with a DUI.

“Does that sound fair?” he asked.

I can’t tell you what the journalist thinks is fair, and of course, my reader friend, I can’t tell what is in your mind.

However, state laws tell insurers what the word fair means, and stripped of legalese, they say a fair rate has to follow the risk as much as possible. People who present great risk must pay more than people who present less risk.

Insurers collect tremendous amounts of data to prove just that.

If an insurer can show that married couples present less risk than others, they deserve a discount. That is fair. It is also fair that men pay more than women and the young pay more than the middle-aged, because the driving records prove it.

Most people think this is OK. They have seen married couples cruising safely in their minivans, and they have been cut off by young, male drivers. Rates follow what they have seen.

By the same standard of fairness, people with poor credit records should pay more than people with excellent credit. Here skeptics balk, yet the data is just as strong, perhaps stronger. Credit information is an excellent predictor of future accidents.

This is harder to understand, I think, because we can’t observe it. I can tell a lot about that fellow who just blew past the stop sign — young or old, male or female — but I can’t tell you, just by looking, whether he is late on his mortgage.

I’ve asked actuaries a lot about credit scores and insurance the past few days. They uniformly tell me its predictive power. People with poor credit incur losses at two or three times the rate of people with excellent credit.

What has surprised me is the certainty and reverence of their answers. One told me, in the jargon: “The models have lift; the standard error is low.” (Translation: Driving record deteriorates steadily, predictably, inexorably as credit score does, without a sliver of doubt.)

Like most actuaries, I’ve known these facts for a while. What surprised me was the respect, bordering on awe, with which these actuaries spoke. They seem to feel they were granted a privileged window, observing something few have — something hard to understand without witnessing it, but once witnessed becomes simple and obvious — as Leeuwenhoek may have felt when he found a drop of water teeming with microbial life.

“The math is there,” I was told. “People just can’t believe what they can’t see.”

Most people benefit from credit scoring. Removing it would raise rates for most people and lower it for a few. And those few will cause more than their share of accidents.

Does that sound fair?