Data makes the systemic cyber risk world go round: Coalition's Motta

By Erin Ayers, Front Page News

Fear of systemic cyber risk losses is “one of the biggest things holding back our industry,” according to Joshua Motta, CEO and co-founder of Coalition, who offered the keynote address at Zywave’s Cyber Risk Insights Conference in New York City on Sept. 27.

“The historical lack of data in our industry has led to significant pricing volatility and more recently, the significant underpricing of risk on the attritional side, when we saw loss ratios across the market skyrocket over the last couple of years. Ironically, the same lack of data has led to overpricing of systemic risk,” he said. “Which is a fancy way of saying - as an industry, we fear what we don’t know. And for good reason.”

However, the industry may be overestimating the likelihood of such scenarios and may already have the data at hand to understand more realistic potential losses more accurately.

“Eighty percent of the world’s reinsurers literally believe the equivalent of ‘the world is flat” -- that they have so little data, they think they might actually go off the edge of it. Or that there’s the possibility that some zero-day attack takes down so much of the world’s computers that we’re all catapulted back to the Stone Age,” Motta said, adding, “Sixty percent of the world’s computers going offline for three to 30 days is the scenario that drives most of the tail … I think the laws of physics would have to be violated for this particular scenario to play out.”

Motta commented, “Consider me a round-earther. And I’m not the only round-earther.” Underwriters should already be able to assess the potential impacts on their clients, a sentiment that is growing in the cyber market, he noted.

Modeled estimates put U.S. economic losses from a systemic cloud services provider outage at approximately $30 billion, which is “not a small number,” but insured losses would likely be far less. The industry just needs to connect the data dots to reach a level of comfort with systemic risk.

“We don’t have to make guesses about what the failure of Amazon Web Services availability looks like. We can see all the policyholders collectively across a portfolio that are using them. We can simulate what that looks like, we can simulate what a zero-day looks like, down to a particular version of software,” Motta explained.

He concluded, “When you have this level of precision, it’s a lot easier to see that the world is round.”

Cyber ‘superhumans’

As a byproduct of the market’s systemic cyber challenges, the sector remains much smaller than the rest of the property-casualty insurance industry, Motta observed. It lags behind both the world’s needs and the rising economic cost of cybercrime.

That’s in part because insurance as a concept and product wasn’t built for a digital world -- it was built for ships sailing at sea, steam boilers, factories, and other exposures arising out of an industrialized world, he said.

“If you had a handful of data points and you had the mathematical law of large numbers on your side, you could insure them,” Motta said. “That’s the basis for the industry we all work in today.”

And while tangible assets presented a reasonably quantifiable risk, the risks to intangible assets are “extraordinarily amorphous.”

“The future very much needs to be about how we insure intangible assets, the ones and zeros that are floating around,” he said, adding, “And we’ll need a lot more data to quantify these risks and, more importantly, to predict them.”

And yes, more technology – but not to cut out the humans, Motta hastened to add.

“All of the humans here, whether you’re an underwriter, broker or risk manager, we’re all still going to be here. It’s just that the future of technology will turn us into superhumans,” he said. Machines and data will help the industry perform its tasks more efficiently, with higher service and more opportunities to help organizations improve their cyber posture, according to Motta – as many market players have already begun to test.

Future insurance companies will be technology companies and those without software engineers right alongside their underwriters may be “substantially disadvantaged.”

Legacy insurance underwriting methods do still work, but a “predictable and profitable” future requires a different approach, including lowering the cost of underwriting, the cost of distribution, and delivering more value to policyholders, Motta said.

That’s not to say cyber insurance is “broken,” he added.

“There’s a lot of people who claim cyber insurance is broken or insurers are dinosaurs but I’m not one of those people. It works. Maybe insurance companies are dinosaurs, but these dinosaurs are still roaming the earth,” Motta concluded.

Managing Editor Erin Ayers can be reached at erin.ayers@zywave.com