As the costs associated with cyber attacks rise, shipping operators are increasingly considering insurance. However, uncertainty around cyber risks is complicating insurance products, exclusions, and claims processes. Research from the Law Society of England and Wales found that 72% of companies across all industries have not purchased cyber insurance. Figures from Maritime London suggest that 92% of estimated costs arising from a cyberattack are uninsured.
Research for this report found that 25% of respondents admitted that their organisation does not have cyber risk insurance, while 42% were unsure as to whether any cyber insurance even exists. According to Law Society President, Lubna Shuja, “Although stability is returning to the market, the process of buying cyber insurance has become harder, with more paperwork involved and underwriters showing greater aversion to risk.”
As a result, companies are still finding it difficult to purchase the right cyber insurance and are all too often investing in insurance policies that do not cover what they need covering. This situation is not surprising Robert Dorey, CEO of Astaara, a specialist marine cyber insurer, told Thetius, “The marine insurance market has been in a state of change as cyber exclusions have removed cyber cover from nearly all marine policies, following direction from insurance market regulators.
However, there are still pockets of the marine insurance market where cyber cover is not specifically included or excluded but instead silent on cyber. This ambiguity is in addition to marine cyber solutions, often excluding war and terror caused losses without clarifying this to the insured. Many in the main cyber market do not understand the unique maritime environment and the operational technology interface with information technology. Complex risks need bespoke solutions.”
Cover applications are being rejected, largely due to eligibility. This can arise from a lack of maturity in cyber risk management. The problem is that companies’ cyber risk management regimes in place are not at the level they need to be to meet eligibility requirements for cyber insurance policies. In some cases, this may not be identified until they become the victim of an attack and realise that their insurance policy does not cover the breach.
Companies first need to check and possibly upgrade their cyber risk management solutions before they can even think about getting insurance. This adds further cost, delay, and complexity to the process.
One interviewee told Thetius that they “see some technology vendors say, ‘Use our tool and you’ll get a discount on your insurance’. But it’s less about discounts and more about eligibility. A lot of companies are getting cyber insurance cover applications rejected or seeing certain coverage restrictions put in place because their cyber risk management regime just isn’t where it should be.”
Rishi Baviskar, Global Cyber Experts Leader, Risk Consulting at Allianz Global Corporate & Speciality (AGCS), admitted in research published by Allianz Global in 2022 that, “More than half of submissions from prospective clients still do not meet our checklist of required controls entirely.”
For a deeper dive into the areas highlighted in this article, take a look at our thought leadership report, produced in collaboration with CyberOwl and HFW, titled “Shifting Tides, Rising Ransoms and Critical Decisions”. This comprehensive report offers insights into the evolving landscape of cyber threats in the maritime industry and explains that there is a new approach towards managing cyber risk. You can download your copy of the report below:
