State-sponsored attacks and the cyber cover question for brokers

Chapter 1: Introduction
0:00 It's in insurers' best interest not to exclude AI.
0:03 Even if you pay a ransom, then the the data is not released or it's released on the dark web or whatever it might be.
0:08 Does not automatically mean that there is no cover. [music] Hello and welcome to Insurance Business
0:15 TV for our quarterly cyber insurance power panel for New Zealand. We're going to look at what brokers should know about cover questions when a foreign
0:23 State attacks and the latest ideas around the barriers to getting more SMEs to sign up for cyber insurance. Our
0:31 Experts are back. Tom Arnut is cyber specialist with Marsh. Damian Shade is client director financial lines at
0:39 Lockton. And Declan Thompson is associate director with GSI Insurance Partners. Um, welcome back again, gentlemen. And Declan, let's hit off

Chapter 2: Foreign state attacks and cyber cover

0:48 With you for this first question. This is quite a complicated one. The New Zealand Security Intelligence Service says foreign states are actively
0:56 Targeting local businesses. I don't I don't think that's a surprise. The question of whether those attacks are excluded from cyber cover can be pretty
1:04 Complicated. Uh there's a clause that blanket excludes all state sponsored attacks. That's LMA 5567 for those who
1:12 Don't know. um that only bites if the country's essential services go down. So if a foreign government is behind the
1:20 Attack, does your client's policy still pay? Yeah, thanks again for having me, Danny.
1:26 I I I would agree that these exclusions and their applications can be complicated. Um, I hate to give a lawyer answer, Danny, but it's it is one of
1:34 Those ones where the devil's in the detail. And I think that it's really important to have a good understanding of the exact policy wording, the exact
1:42 Exclusions, and how they apply. That exclusion that you referenced, could be wrong, but I think it's one of those Lloyd's sort of exclusions that's been
1:49 Flying around a bit. I would say for most New Zealand cyber policy wordings that that I'm familiar with, um I would
1:57 Say that a foreign government being behind a cyber attack is does not necessarily mean or does not automatically mean that there is no cover. And so that's something that I guess I would be relaying to clients.
2:07 It's in general I would say that the exclusions are intended to uh you know exclude attacks connected with war or um
2:15 Those causing major impacts on national services. So they can be broad in the sense of what they're intending to exclude, but at the same time, I would I
2:24 Would honestly say that they I would see them as pretty fair and reasonable in terms of what insurers are willing to still cover whilst looking to exclude,
2:33 You know, certain events. So it is a it's a really relevant conversation.
2:36 It's really important that clients have a clear understanding of exactly what is excluded. But at the same time, I wouldn't say that it's something that
2:45 Should drive a large amount of decision making around cyber risk or cyber insurance at this stage. So yeah, really important, not necessarily something
2:53 That I think that um is unfair or should be driving decision-m.
2:59 Great. Thank you, Declan. And Damian, tell us about the devils in your detail in these foreign state attacks.
3:07 Thanks, Danny. It was nice to be here. Um you look, I echo Declan's comments.
3:11 It's a it's a really challenging space and I think especially when there's been an incident or an attack trying to ascertain where it's actually come from was it's sort of in a simplistic sense
3:19 Is very challenging. It's not always a it's not always black and white. So I think having a policy that's going to respond in the first instance to provide
3:27 The cover obviously the incident response piece and the like. Um and working with an insurer that understands the the vagueness can occur is probably
3:35 The most critical piece. But yeah, echoing Declan's comments around the um the the detail and the specifics of of the wording. But I I guess insurers is
3:43 Is a market sort of taker trying to manage the I guess aggregation risk across the the whole portfolio in respect of um state sponsored attacks.
3:51 And if there was sort of yeah ended up cyber terrorism across sort of cross borders, it's going to sort of have a wipe out the entire almost cyber market.
3:59 So they need to manage it via that way.
4:01 But on the flip side, it exactly not every sort of um attack involving a state is going to be excluded. So yeah, a really really interesting conversation
4:09 And really important particularly for those clients that have that sort of exposure if they're involved in sort of government, local government kind of contracts and that sort of thing. Um probably more prevalent conversations.
4:20 Thanks Damian and Tom. Welcome to you. I didn't welcome the other guys but very good welcome to you. Um how do you see this foreign state issue?
4:31 Yeah, thanks Danny. It's good to be back talking with you and the guys again. Um, yeah, it's a tricky one. Um, I mean, we've seen war exclusions on the
4:38 Policies for quite a while now. Um, again, it's, you know, to echo the guys that, yeah, the devil is in the detail.
4:45 Um, and I understand there's a few different versions of the wording or exclusion. Um, but as I understand it,
4:52 It's yeah, um, if if there needs to be an impacted state. So, um, look, I don't want the war exclusion to be a barrier
4:59 To entry for clients, particularly in New Zealand. Um, it should certainly not scare people off. Um, and I don't think I've seen the war exclusion actually
5:07 Tested in New Zealand. Um, but again, it's really important to check the wording. Um, check the definitions in these exclusions. Um, and they may
5:15 Differ um, slightly depending on um, different insurers interpretations and they may have their own versions. So, um, yeah, war exclusions is something
5:22 We've always got our eye on. Um, and yeah, really important to just read the read the detail.
5:27 Tom, let's stick with you and and look at something that's a I guess a more familiar topic in terms of cyber um barriers, I guess, to to people taking

Chapter 3: Why SMEs aren't buying cyber insurance

5:36 It up. Um, when you look atmemes and why they're not buying cyber insurance, price is often brought up, but um I've
5:44 Been talking to a few brokers and insurers who are saying it's actually the the 10-page proposal form that they get from insurers that they find pretty
5:51 Tricky to fill out. I mean, do you agree that the complexity of what the clients have to submit in proposal forms is an issue? And if so, who should be fixing that?
6:02 Yeah, I think it's really up to insurers um to to fix that. I mean, it's their proposal form and look, no client likes filling out forms. Um I certainly don't.
6:10 Um and yeah, we are seeing some insurers start to just ask less questions. Um and it certainly bodes well with the clients. Um they're not filling out
6:19 10-page forms. Um, but a lot of insurers do still require quite a bit of detail.
6:24 Um, but again, the market is soft and I think insurers will certainly have an advantage if they're um, adapting and asking less questions. Um, I've seen
6:33 Insurers ask for a website and a few basic details and that's it. Um, and you can get a quote that way. Um, so I think there it's certainly a trend and it will
6:41 Continue that way. Um, and we're working with insurers to to see how we can best uh, shorten their proposal forms.
6:48 And Dean, how about you? Is is the the proposal form from the insurer an issue?
6:53 And if so, who's supposed to fix that? I suppose the the background question here is if the client isn't filling it in, I guess it falls on to you, doesn't it?
7:02 Yeah, good question. Look, I I would agree I I would agree that it's definitely a barrier. I I wouldn't say that that's necessarily always a bad
7:10 Thing. uh sometimes especially in the last couple of years one thing that's been really useful about these proposals is that it prompts very useful
7:18 Discussions with the clients that you know that do want to sort of approach it rather than just having it been yeah you can take this you can take this policy
7:26 On for this cost. Um, so and those conversations tend to help improve their cyber risk management, which is, you know, really where we can offer some
7:35 Value and and make things more about the the risk management as opposed to just cyber um insurance being like the
7:42 Ambulance at the bottom of the hill. I think your question, Danny, is great because, you know, a lot of our clients will just point it up to their IT sort
7:50 Of um providers or their IT suppliers and that kind of thing to get some to get some answers back. Again, that's not necessarily always a bad thing because
7:58 It is important that insurers get the right sort of amount of information. Um, I do think I'll I'll sort of jump on
8:07 What Tom was saying as well that that we had an interesting presentation from a cyber insurer recently that sort of said, hey, look, with all these questions that we've been asking
8:16 Historically, actually, we found they didn't really make any difference to cyber ratings or weren't really that impactful when it came to cyber risk
8:23 Management evaluation. So we've started to remove those and I think that's really useful for a lot of clients that you know because it it is a bit of a
8:31 Pain to have to go through 100 questions and then insure it to say actually it's not that relevant here's your is your premium anyway. So I do I do like that
8:38 We're sort of moving the direction of easier questions and less questions if that makes sense.
8:44 Yeah. Thanks Declan. Damian, how about you? Where do you stand on the insurers 100 question proposal forms?
8:51 [laughter]
8:51 Yeah, look I'm on the same page. I think there's been so much evolution in the past five six years probably since post pandemic with with insurers the
9:00 Reduction of requirements of what insurers actually need. So I'd almost challenge that question a little bit because I think there are a number of markets that will provide coverage with
9:07 Very little information and as sort of Tom alluded to um in Declan as well they will do it on the back of a URL and they'll do their own um investigation
9:16 From a vulnerability perspective. um they'll ask a couple of que key questions around um the obviously the standard stuff around multifactor
9:24 Authentication and how you manage data and network segregation and do you actually how your employees um go through training process and once
9:32 They've got that essentially got enough knowledge to be able to underwrite it.
9:35 So the the days of those sort of long proposal forms I think are are very kind of uh outdated and if insurers are still asking for that level of information um
9:43 As a broker I'd be sort of looking to to pursue alternative markets for insurers that kind of have a different approach and certainly not short of insurers or
9:51 Capacity. So there's there's certainly a number out there that that don't require that level of detail. Um and as sort of yeah um Declan alluded to a lot of it is
9:59 Sometimes irrelevant now. So thank you Damian. Um let's stick with you for our next question. Um this is looking at a survey by Convolt. 

Chapter 4: Ransomware payments and incident response

10:08 They surveyed more than 400 organizations across Australia and New Zealand and this is looking at ransomware payments.
10:14 A third of um the ransomware victims paid but more than a third of those payments failed. Um I'm just wondering
10:22 What sort of conversations you're having around ransom payments. I mean yeah just just because that's must be a tricky a tricky conversation but an important one to have.
10:32 Yeah know absolutely a very very tricky conversation. I was um actually in the UK a couple of weeks ago with a number of cyber markets and clients. So had a
10:40 Really sort of good gauge of what the market's looking like from a global perspective. And obviously ransomware is sort of sucking up sort of quasi 70% of
10:48 Claims at the moment in terms of cyber claims arising from ransomware and and the landscape as you kind of will be well aware has changed quite
10:56 Significantly from a I guess it's a funny way to talk about it but I guess a respectable landscape with a two or
11:03 Three sort of you know well reggarded um dodgy criminals um that are extracting most of the information as a a
11:11 Ransomware for service kind of operation And um when they extort or they ransom, they obviously um and they receive a
11:20 Payment, the data is obviously released or or the encryption's released. So um there's there's no general issue. But unfortunately now the landscape's
11:27 Evolved a little bit and the I guess the barriers to entry for those sort of ransomware as a service operators has reduced um particularly with obviously
11:35 Influx of AI and and other tools. So there's more of them in the market and then maybe not as sounds to a funny way to describe it maybe not as good criminals as the uh as the other guys.
11:45 So they are not paying the ransom um or they are not releasing the data or um encrypting it. So that creates a bit of
11:52 A headache as well. Um so yeah it's it's it's an interesting dynamic but I think the the main sort of point coming out of it is the critical importance of that I
12:02 Guess that cyber hygiene or that risk management in behind it to um reduce the chance of even getting to to that stage and and having a really strong process
12:10 In place to manage an incident response um and manage the ability if you yeah if there's an extortion or a ransom on data
12:18 Or it's released um knowing what your steps and processes are going to be and actually having tested suppose um because yeah you could be in a situation
12:25 Where if yeah even if you pay a ransom then the the data is not released or it's released on the dark web or whatever it might be.
12:33 Well thanks Damian Tom tell us about some of your ransomware headaches. Yeah, of course. Yeah. So, ransomware is that
12:40 Um that interesting thing where you know obviously no one wants to pay a ransom.
12:45 Um but at the time of a ransomware, uh incident response teams will typically um deploy forensics teams. Um and I've
12:52 Seen trends of ransoms actually going down, clients aren't paying as much, which is fantastic. But depending on the data that's at stake um for a client, it
13:01 May actually make more sense um for that client to pay the ransom. Um, again, depending on what's at stake and the fallout from not paying may actually end
13:09 Up being more severe. Um, so yeah, clients have a lot of support at the time of an incident or a ransom specifically. Um, so yeah,
13:18 Thanks Tom. Declan, tell us about some of your ransomware conversations.
13:24 Yeah, I think just to add to what sort of Tom was mentioning in terms of the support, you know, you receive at claims time. We found especially internally with some of the cyber claims that we've
13:32 Managed. Um absolutely sometimes uh you know in terms of these ransomware events your data and your networks and your
13:39 Systems are uh not restored to the same level that they were prior to a loss. So those instant response teams and those investigative teams can be really
13:47 Supportive. Um, and I think in in terms of the whole ransomware conversation, I'm hoping that there aren't many brokers out there that are talking about
13:55 The reliance on an insurance policy um, in terms of ransomware coverage and more so shifting the conversation or at least in
14:04 The last 6 months or so, year or so toward or what can be done regardless of ransomware cover what can be done in an
14:11 Internal sort of cyber risk management um, conversation. I know when a lot of insurers are sort of directing or asking
14:18 Now around business continuity plans and disaster recovery plans. So I think that it it's really important not just for clients to have understanding of what
14:25 Ransomware coverage there is but also what they can do on on their end in terms of you know backups and being offline and offsite and being
14:33 Appropriately tested so that in the event of like these you know in these kinds of events there's at least some recourse or there's there's amount of
14:41 Kind of reconstruction that can happen without the need or without the reliance on a ransomware policy. Um, so I think
14:48 Yeah, that the conversation is probably shifting more so to what cyber can do as opposed to now, hey, look, you know, what what kinds of internal risk
14:56 Management can we can we implement so that cyber can be there in the background as you need it and when you need it, if that makes sense.

Chapter 5: AI-enabled attacks and policy coverage

15:04 Yeah. No, it does. Declan, let's stick with you. We haven't talked about AI yet. Um, but we're not going to get away without talking about it a little. Um I
15:12 Guess the context for our conversation is um AI godfather Jeffrey Hinton coming out and saying that everyone should be slowing down their adoption kind of
15:21 Supporting what's been going on from other AI leaders. Um still when it comes down to you guys it's all about what
15:28 Does the policy do when there's an AI enabled attack. Uh what are you telling them at the moment? Yeah, I think
15:36 There's two conversations that are happening with clients a lot these days which is which is one both the internal use of AI and then two the external you
15:45 Know what are my risks with AI enabled cyber attacks. So in terms of that I guess AI enabled cyber attacks from third party I would our conversations
15:54 With clients are still sort of hey look in terms of cyber policies as they are currently there's still a lot of support and there's still a lot of coverage on
16:01 Offer because they they focus more on the the nature and the outcome of the cyber incident rather than the the methodology or the technology that's
16:09 Being used to attack the company. Um, so there's still a lot of I guess confidence that we've got in cyber and cyber policies being able to respond to
16:19 AI related attacks. I think if I'm honest, there are some insurers now who are have understood that this is a a topic of conversation and have started
16:27 To introduce it into their policy wordings to provide clarity and literally specify that, you know, AI enabled attacks are covered under
16:36 Certain insurance clauses. So there's a lot of comfort that can be provided there.
16:42 Um for our clients. And I think on on the other hand in terms of internal internal AI use, we do get that question a lot, you know, in terms of clients
16:50 Inputting data into into AI models or into AI systems. Um you know, how would that how would the policies respond and
16:59 What does what does the sort of risk look like from that front? that can be a trickier conversation in honesty because there's other policies at play when it
17:07 Comes to that sort of uh whether there's an error and emission or you know how that data could be could be used. So
17:15 There's there's still a lot of again there's a lot of support that we can offer in terms of or there is a lot of support in the wordings from insurers as
17:22 They are currently. Um, and so I think the conversation at the moment is yes, AI is relatively new for the moment cyber policies are still, you know,
17:31 Still intended to respond to the core risks is how we address that.
17:37 Damian, sounds like Declan is confidently comforting his customers, clients. Is that what you're doing too?
17:44 Are you reasonably happy with how the policies are handling AI at the moment?
17:50 Yeah, look, I think so. I I think there hasn't been any influx to put AI exclusions on or anything like that. And I think that we would sort of be having
17:58 To keep a close eye should a something like that evolve in in the market particularly from a cyber perspective because it has multiple connotations.
18:05 But obviously I think from an AI perspective we're seeing the increased number of claims from social engineering perspective with that sort of um
18:13 Approach of being able to weaponize the the model and just attack more uh more um vulnerabilities at the same time. So you're kind of just creating more of a
18:21 Frequency from a a claims issue. But um yeah, look, I think from that perspective, AI is um yeah, it's always going to be a topic. And I think
18:30 Insurers that the main things that they're concerned about if we look at it from uh from a client and a broker perspective is is they want to make sure
18:37 That clients, our clients understand what AI they're using and how they're using it and that that they understand the function of it and where the data is
18:45 Coming from if it's subsequently going to third parties. just really having a bit of governance around the tools you use internally um what and how that's
18:53 Managed and then obviously um what goes external as well. So I really just uh they want comfort that you understand how it's being used and and what's going
19:02 On from a from a first party perspective and then obviously that culminates in and sort of the coverage and and that provided but at the moment yeah I kind
19:10 Of mirror Declan's comments around um around the current market stance.
19:15 Thanks Damian. Tom you get the last word. What are you telling your clients about AI enabled attacks?
19:21 Yeah, I mean I'm going to sound like a bit of a broken record here. Um, but the guys nailed it. It's really a two-sided uh coin. There's the government's piece
19:29 Or governance piece rather um which you know can lead to ENO loss. Um it's important that businesses and clients are ensuring that um they're controlling
19:38 AI and how it's used within businesses and what data is actually going out. Um but there's a whole conversation in that. But um the other side is of course
19:47 You know a lot of clients are still saying oh is AI covered um if I'm hit with an AI enabled attack um is my policy going to respond and yeah
19:54 Absolutely it will um I think it's insurers' best interest not to exclude AI from cyber um uh policies um because
20:03 Then there'd be no cover right um a lot of AI um AI attacks are becoming a lot
20:09 More pre um common so as AI models get more advanced um threat actors are going to be using it more. Um so at some point
20:17 Um further down the track pretty much most um cyber attacks will be uh powered by some form of AI. So yeah um but at
20:25 This stage we're quite happy um with how the market is reacting to AI. Um but it's one of those things that we've just got um keeping an eye on.
20:34 Thank you Tom. Thanks also to Declan and Damian. And that concludes our cyber panel for New Zealand. Thanks for watching Insurance Business TV. Bye for now.