Cyber ​​insurers are the winners from the biggest IT outage ever

Unlock Editor’s Digest for free

FT editor Roula Khalaf selects her favorite stories in this weekly newsletter.

July’s global tech outage broke all records. He grounded planes, interrupted medical appointments and took out radio broadcasters. But the impact on the nascent cyber insurance sectors has been low. The vast majority of the costs – estimated at $15 billion – were not insured.

If the chaos had lasted longer, it might have been a different story. Most policies don’t go into effect for about eight hours after the incident begins. The cause of the IT outage was a bug — a botched update from cybersecurity company CrowdStrike — that was much easier to fix than a cyber attack. Risk retention and policy limits also help limit insurers’ liabilities. They will likely pay less than a fifth of the estimated $5.4 billion in losses suffered by Fortune 500 companies (excluding Microsoft), according to insurer Parametrix.

Beazley, a market leader in cyber insurance, played down the incident last week, leaving profit guidance unchanged. Berenberg’s Tryfonas Spyrou estimates Beazley’s potential loss at $80-120 million, which can be comfortably absorbed.

Insurers cannot be sure that they will have it so easy in the future. This is one of the rarest corners of the insurance market. There is limited data on which to make judgments, although the recent outage will provide useful data. There is no escaping the enormity of the potential risks. Beazley estimates that the type of natural catastrophe that could occur once in 250 years would have a 26% impact on its credit rating. The equivalent cyber event would be 5 percentage points worse.

But the market rewards companies for taking these risks. Beazley’s combined cyber business ratio – a closely watched measure of losses plus expenses as a percentage of premiums – at 69% is 8 percentage points below the group average.

In addition, insurers can and should mitigate risk through careful underwriting. In 2021, Beazley dropped a large number of policyholders who did not have adequate controls. It pioneered cyber catastrophe bonds to offload some of its risk. It also imposes exclusions and limits in the event of war, a malware outage by a sovereign state, or an extended cloud outage of 72 hours or more.

Insurance is only a partial solution to growing cyber risks. Coverage is expensive and limited. However, policy demand may get a boost from the recent disruption. Risk managers have already been spooked by cyber threats, according to the Allianz Risk Barometer. The paralysis induced by the “blue screen of death” strongly reinforced the message.

[email protected]