HEAD ON: How Guy Carpenter and CyberCube Partnered to Tackle Cyber Insurance
By CyberCube CEO Pascal Millaire and Co-Founder Ashwin Kashyap
The fear surrounding cyber-attacks has never been more warranted. In 2017, there was a 46% increase in new ransomware variants, a 54% increase in mobile malware variants and a staggering 600% increase in Internet of Things (IoT) attacks, according to data from Symantec.
Notably, hackers also cost the consumer $172 billion last year – and according to research supported by CyberCube, currently cost the global economy in excess of $275 billion per year.
As new technology enters the market, these number will undoubtedly grow. And yes: the size of the cyber insurance industry will follow suit. While today premiums are estimated at about $3.5 billion, sales could reach $20 billion by 2025. Cyber risk has been etched into the global landscape, and shareholders and regulators are turning to the insurance industry to confront these risks. In the current scenario, it’s prudent for the cyber insurance market to be prepared with the superior insight and tools needed to help their clients succeed.
Here’s how leading global risk and reinsurance specialist Guy Carpenter tackled cyber insurance head-on, by engaging in a two-year strategic relationship with CyberCube, formerly part of Symantec Corporation. The result of the partnership is the industry’s first cyber risk modeling platform with an inside-out view of the cyber risk exposure.
An Urgent Market Need
It is one thing to develop insurance models for physical locations. However cyber insurance is a completely different game. Aggregation can stretch across millions of connected systems – and just because a risk hasn’t materialized yet, it does not mean that the risk is not there. But since cyber insurance is a relatively new line of business, there is a limited amount of data available. This makes it more difficult for insurers and reinsurers to measure cyber risk and profitability effectively.
Further, the cyber insurance market is in a constant state of transformation. The types of cyber-attacks that may occur – as well as the motivations behind them – are never at a standstill. Damage done by cyber-attacks is also inherently more difficult to quantify, and it might take days or years to discover that one has taken place. Additionally, the attacks often happen over an extended period of time.
All these factors make entering the cyber insurance space an enormous challenge for traditional insurance players. The partnership between Guy Carpenter and CyberCube aims to combat this. Guy Carpenter provided the invaluable insurance market insight and feedback, while CyberCube brought its cybersecurity and modeling expertise to the table.
The Cyber Risk Modeling Platform Helps Insurers Make Better Decisions
Using technology developed by Symantec – the world’s leading cybersecurity company – the new risk modeling platform leverages exabytes of data from security products, which is then analyzed with a specific focus on cyber risk measurement. And the goal? To help insurers make more informed decisions when underwriting cyber risk and managing cyber risk aggregation.
But there is no silver bullet to addressing how the cyber risk can be measured. To develop the product, both parties analyzed the problem from various perspectives – speaking to experts in actuarial science, cybersecurity and insurance risk modeling. The result is the first multi-faceted platform to provide an inside-out view of the cyber risk exposure.
The risk modeling platform provides the global insurance industry a view of potential systemic risks, modeled through simulation. For example, certain years can be good for insurance, and others can be catastrophic. Companies that analyze their insurance portfolios with CyberCube’s modeling platform get a clear view of what tail risk for the portfolio looks like, in the form of losses at the 1-in-20, 1-in-50, 1-in-100 levels.
These metrics are fundamentally important to make decisions about how much reinsurance an insurer should purchase given its risk tolerance limits. Further, the tool easily integrates with industry standard capital modeling platforms like MetaRisk.
Even more, the risk modeling platform features a transparent way for companies to see how metrics are calculated, to then understand the key drivers of cyber risk. For example, a certain portfolio may have a higher concentration of risk in the financial services sector – even if they don’t think they do. It can also have a higher degree of exposure to a certain cloud services provider that may not have the leading market share. This capability enables insurance carriers to understand risks across multiple segments and set a streamlined underwriting strategy.
Finally, the platform is a proving ground for sensitivity testing and customization. When an insurance player is assessing tail risk, being able to quantify uncertainties through sensitivity testing is critically important. For example, what happens to modeled losses when one changes the business interruption waiting period from 8 hours to 12 hours for all policies in the portfolio? How do the metrics change when one simulates events in a future world, where cyber attacks might not be as frequent? All in all, CyberCube enables insurance players to create their own view of the cyber risk by configuring frequency and severity controls.
How Insurance Companies Can Benefit
As a reinsurance broker, Guy Carpenter is a key influencer in enabling the transfer of risk between insurers and reinsurers. These transactions are quite complex. But the good news is that now in the realm of cyber, CyberCube can provide advanced analytics to inform on tail risks, and Guy Carpenter’s actuaries and brokers advise insurers on their reinsurance programs on the basis of the model.
All in all, Guy Carpenter became the first reinsurance broker to enter into a formal license agreement with CyberCube to leverage the technology – and thus, deliver innovative cyber reinsurance solutions to its clients.
“Guy Carpenter is excited to offer our clients and prospects this exciting new tool to help manage and assess cyber risk,” said Guy Carpenter’s Global Chief Innovation and Product Development Officer Claude Yoder.
“The powerful combination of our knowledge of (re)insurance dynamics and the evolution of the product and macro-systemic industry concerns, coupled with CyberCube’s expertise in data science, cyber security, software engineering and actuarial modeling, will deepen the industry’s understanding of this rapidly evolving risk.”
Cyber insurance is still full of unknowns. Even Warren Buffett was recently quoted in saying that cyber is unchartered territory, and risks will, in fact, get worse in the years to come. That said, insurers will seriously benefit from partnering with cutting edge technology companies to help get a real handle of cyber risk – and in the end, provide the right coverage their clients deserve.
Pascal Millaire is the CEO of CyberCube, a Symantec Ventures company dedicated to providing data-driven cyber insurance underwriting and aggregation management analytics. Previously, Pascal was Vice President at Symantec, where he was responsible for overseeing cyber insurance product development and insurance security partnerships. Pascal was also President of an Internet of Things technology company and spent seven years at McKinsey and Company where he served companies in the insurance industry on topics of strategy, risk management, pricing, and operations. Pascal holds a Bachelor’s degree from the University of Cambridge and an MBA from the Stanford Graduate School of Business.
Ashwin Kashyap is a Co-founder and Product Executive at CyberCube, a San Francisco based cyber-security startup where he leads the creation and commercialization of a cyber risk management platform. Prior to CyberCube, Ashwin was the Director of Product Management at Symantec, the world’s largest cyber-security company. He has spent his decade-long career in technology focused on creating quantitative models and products for the insurance eco-system and is a frequent speaker on risk analytics in industry events. Ashwin has a Master’s degree in Electrical Engineering from the University of Michigan, Ann Arbor.
