Cyber market pressure points: Losses, litigation and pricing sustainability

00:00 - Joe Erle
We're trying too much to be cyber security companies instead of just staying in our lane as cyber insurers.

00:00 - Jennifer Wilson
AI is a technology that AI is the tool. It's not the peril.

00:00 - Keith Savino
If you're using the same AI to answer those questions and both sets of AI are hallucinating with each other, that might be called an E&O exposure.

00:00 - Paul Lucas
Hello everyone and welcome to our Leaders Network cyber insurance panel. Now building on our prior discussions of pricing and systemic risk, this session looks at where losses are actually heading, a recent legal decision reshaping breach litigation, and an honest scorecard of where the cyber market is getting it right and wrong. And to take us through all of the market developments, we welcome back Joe Erle, cyber group practice leader at C3 Risk and Insurance Services, Jennifer Wilson, senior director cyber at WTW, and for the first time Keith Savino, CEO US at Emergence Insurance. So welcome everyone and let's start with a little bit of a scene setter if we can. I'd love to know where is the cyber market actually heading next? Loss frequency and severity both appear to be increasing of course, so is the market at risk of perhaps over correcting in response, Jennifer?

01:01 - Jennifer Wilson
That's a great question, Paul. I don't think we're at risk of an over correction by the market, but I do believe that we are going to start seeing a course correction, a slight course correction over the next 12 months. We're already seeing carriers start to hold rate and walk away from big deals because they don't want to offer significant decreases. So I think gone are the days of the, you know, significant race to the bottom and we'll start to see carriers across the board hold rate more.

01:35 - Paul Lucas
Okay. Joe, are you thinking there'll be any relief to the soft market?

01:35 - Joe Erle
Well, I'm usually wrong when I hope the market's going to turn. I'm going to bet on the market staying stable and we have too many new entrants into the cyber insurance market, too much VC money, and I believe that underwriting has gone better and cybersecurity in general, including backups, has gotten better, which has caused ransomware claims to not be paid as much, which has helped keep the market stable. So, I'm betting that everything stays low and that we're not going to see any increases with the exception of some higher risk classes like healthcare.

02:10 - Paul Lucas
Ken said a pretty positive outlook, but Keith, I imagine the size of the risk is really important here.

02:45 - Keith Savino
For sure. If we're speaking about the SMB or SME space, then you answer it one way. If you're speaking about larger accounts, you might answer it another way. I'll piggyback on what Jennifer said. Yeah, I don't think you'll see large over correction, and that ties into what Joe was saying is that you have a lot of capacity and a lot of competitors. So, where you have capacity and competitors, you're going to have, you know, a quest to win. You also have a really big green field here in certain size risks. So, there is going to be some competition to win those risks, but you're tagged to not be competing on renewal with some of those. So, the new business acquisition is one conversation, the renewal win on a risk you've been trying to win for a few years is a different conversation. Um but I don't see a tremendous over correction unless there's some substantial series of events that causes everybody to change their attitude around guidelines and around the classes that they're interested in writing.

03:45 - Paul Lucas
Well, I mentioned at the top of course a recent court decision. That was of course the Illuminate court decision, which involved a software company serving schools that suffered a data breach and reportedly has made it easier to bring future medical breach claims. So, Joe, from your perspective, what does that mean for how cyber risk gets underwritten and indeed litigated going forward?

04:13 - Joe Erle
It's an interesting case because Illuminate actually won this one, but the precedents changed a lot of things because uh while Illuminate wasn't at the threshold of being a medical company, the threshold of data being breached and we don't have to have a hacker look at it or to be leaked. It just has to be a significant risk of it being breached. And with CMIA uh finds of a thousand dollars per record, those breaches can get pretty big pretty fast and now we don't even have to have proof that a hacker leaked it.

04:45 - Paul Lucas
Right. So, this sounds like this potentially changes quite a lot, Keith.

04:45 - Keith Savino
I think I said before that every claim, particularly substantial claims or something that could turn into a surgeon class actions, is going to have an impact on the industry and on their guidelines and on their appetite. So, you might see this impact certain classes of business more than others. I mean, we mentioned health care, but these types of events and lawsuits and class action lawsuits will impact what an underwriter thinks when you're looking at something, but it's also going to impact the appetite and the guidelines for carriers in the future. I also know that folks tend to re- re- respond with new technologies and new ways of looking at risks and we've seen that over the past 25 years in the cyber industry.

05:18 - Paul Lucas
Okay. Jennifer, do you agree with the points Keith's making there?

05:55 - Jennifer Wilson
Yes, I agree with that. I think that the Illuminate case is very reminiscent to what we saw in the Six Flags decision as it relates to biometrics. It's no longer about the um potential economic loss. It's more about the potential exposure. So, it doesn't need to be you don't need to prove damages in order to recover. So, I think we're going to continue to see the underwriting lens evolve alongside these the litigation similar to what Keith is saying.

05:55 - Paul Lucas
Okay. Well, let's be candid with each other if we can. I'd love to know what the cyber market is doing right and indeed what it's doing wrong at the moment. Is underwriting still too reactive as coverage genuinely evolved to match the threat landscape? And indeed, which carriers, if you dare to mention any, are actually handling claims well? Uh Keith, let's get your thoughts first.

06:28 - Keith Savino
I love the evolution of the cyber industry over the past 25 years. You know, I think we've gotten better at doing a lot of things that worse. Uh I don't know if you could say that about everything we do every day in our lives, but the industry has moved from, you know, 22-page applications that were overbearing that pretty much guaranteed no one would actually complete them to uh thinning down the applications possibly without some of the third-party data and secret sauce to now having the combination of the third-party data, the secret sauce, and being able to help each and every carrier really write what they want to write. So, now you have a lot of options. People can target what they want to write. They can target the size of the risk. They can target the class of the risk. They can have adequate pricing for that risk. So, I think we're probably in a good place. And then on top of that, a lot of the proactive tools that are offered and the reactive so that we're not just reactive, but we're proactively monitoring our clients throughout the year have made, you know, the cyber insurance space what I would call a standard option now for folks. It's no longer a specialty line that we're still cool, by the way, even if we're not special anymore, we're still cool. I think we're the coolest line of business. But the But the cyberspace is a place where everyone knows that they need to have coverage, and it is available to virtually every class of business. So I like to say that we've made some great strides in the past 25 years.

07:48 - Paul Lucas
I love that positivity and indeed that the overview. And if we If you're bringing ourselves right up to date though, Jennifer, I guess we have to talk a little bit about AI. How is How is the cyber sector handling that at the moment?

08:16 - Jennifer Wilson
Well, I want to I'll get to that in a second, but I do want to respond to what Keith said. Keith, I know you were around back in the day when it was just a one-page application. So prior to the

08:16 - Keith Savino
email addresses do you have? That was a question on an application when I started. And it might have been AOL and Prodigy.

08:16 - Jennifer Wilson
That's right. So it has evolved quite some from the one-pager to the 22-pager, and now we're back to something that's a more reasonable. But I agree with so much of what Keith said with regard to what we're doing right. You know, prior to the pandemic, nobody was talking about MFA or ADR, and now we've all had to become cybersecurity experts in order to sell cyber. So I do agree the evolution is making all of us better. I So I think that, you know, to Keith's point, we have much broadened coverage. The applications are now focusing on all the right things, not just a blanket throwing every question at the table. And I want to respond to we're still the cool people. I think I remember back in the day, pre-pandemic, when you know, when the producers would say, um, "Well, Jennifer, you can come to the meeting. We're probably not going to talk about cyber." And you know, we're really going to focus on D&O. And now the D&O of folks are kind of in the backseat. And now it's like, "Jennifer, it's your show." Now, so we're very much still the cool folks in the room. Um, so it has evolved so much for the better. I think AI is pushing the envelope a bit across the board with brokers, with policyholders, and with underwriters. We all are evolving, and the risk is already there. And we're all kind of learning this risk as we go along. So, I think uh the saying is, you know, kind of building the plane in flight. That's what we're doing right now. And so, I think some folks are managing AI, um, appropriately, and others are still kind of uh trying to keep up. Um, I think, you know, there are insurers out there who are saying, "Yes, we've got AI coverage." And they've included AI language on their cyber policy. But for AI developers, that's somewhat irrelevant because they're looking for the AI language on their tech E&O policy. So, I think there's still quite a long ramp for education, um, and expertise in the AI space. And we're not quite there yet. But we're

10:38 - Keith Savino
But we're evolving.

10:38 - Paul Lucas
That's been an overwhelmingly positive set of answers so far. Joe, from your perspective, what do you think has been done well?

11:11 - Joe Erle
I think the underwriting is going very well. I think the cybersecurity on the customer side is going well, too, especially with backups. We've seen record lows of ransomware paid. So, that's a good sign that customers aren't paying as many ransoms. And then on the flip side, I think where the industry might be going wrong is that we're trying too much to be cybersecurity companies instead of just staying in our lane as cyber insurers. I think cyber insurers and cybersecurity companies should be working together but not trying to you know, take over becoming cybersecurity companies.

11:41 - Paul Lucas
Yeah, well I just want to go back to the point that Jennifer spoke about a little bit earlier when she dealt into a little bit around AI risk. Of course clients increasingly equate cyber risk with AI risk which isn't of course accurate. So Jennifer, just to elaborate a little bit more if you don't mind, what would you say is the most common misconception that you're having to correct with clients right now?

12:10 - Jennifer Wilson
Right now a lot of clients think if they have cyber insurance, they have AI coverage and that's a very common misconception. AI is a technology that AI is the tool. It's not the peril. So AI could cause a loss under cyber. It could create a loss under tech E&O or D&O or EPL. So I think it's very important for both policyholders and underwriters to look at how the AI is being used and what could happen if it's operating in an error. What would that loss cause? Would it would it cause a loss under D&O, EPL, tech E&O or cyber and make sure that we're properly protecting that exposure.

12:56 - Paul Lucas
And then Joe, do you think that the language that's being used around AI is a little bit problematic here?

13:26 - Joe Erle
It can be. I think that one of the biggest misconceptions is if you don't have AI affirmative language that you don't have AI coverage. A lot of companies still cover AI under their software language. If you're developing software and that software includes AI, it's still covered under the software development part of it on a technology errors and omissions policy. Another misconception is that if you have AI affirmative coverage, you have coverage for all AI. There are differences between types of AI. Uh there's also differences between the way you use AI, whether it's your employees using the AI through an LLM like Claude, and also if you have AI agents out there uh with or without supervision uh making decisions on your behalf.

13:58 - Jennifer Wilson
I agree with some of what Joe said, but I also think some of what Joe said is creating um part of the misconception. So, there is there are carriers out there that are promoting that they have AI coverage, and it's misleading to policyholders thinking that they have the coverage. They're just slapping AI language, say on their cyber policy, but they don't have it on the tech E&O. Um I do think And then there are some companies that some carriers out there who do have affirmative AI, and it's narrowing the coverage, not broadening it. And then there are other carriers that truly have the um effective and appropriate affirmative AI language that is broadening the coverage, and without that broadened coverage, there is no coverage on the standard cyber and tech E&O policies. Some things, for example, uh hallucinations, bias, that is not going to be covered on the standard tech E&O policy without the affirmative AI coverage. There are also exposures that would fall under cyber that without the affirmative AI language would not be covered. So, this goes back to the point where there's still a great need for education on the broker side, on the carrier side, and then it's up to us to educate the um insurance purchasers.

15:14 - Joe Erle
Yeah, I like what she said there. There was a recent case that just came out a week or so ago about a Stanford advertiser [clears throat] taking a picture of three students and uh race swapping one of them uh for a banner to hang up in their cafeteria. Now, that's going to affect different policies. The one policy that we never really talk about that kind of gets added on sometimes to an uh cyber policy is a media liability policy. And I think people need to take a closer look at that, too, because people are using AI for media more and more often. We're um opting out of using a graphic designer. Uh and we're you know, skipping some approvals um at the higher levels, and we're just putting stuff out there. And uh you know, obviously, it's caused a lot of controversy, and that could, of course, cause a lawsuit under EPL, D&O, media, and you know, maybe a cyber policy, too. So, I just wanted to put that out there that, you know, it is more complicated, like Jennifer said, and multiple types of policies need to have AI clauses on them for you to be properly covered.

16:22 - Paul Lucas
Oscar, you involved in the debate as well, Keith?

16:51 - Keith Savino
Joe, thank you for pointing out this is not just a cyber insurance conversation. This impacts so many lines of business, and as Jennifer pointed out, being silent on it doesn't isn't always the answer uh because there are carriers who are introducing endorsements, or they're called enhancements, I put it in quotes, um that are supposed to be helping, but what they're usually doing is narrowing the scope or the frame, and they're putting wording around it because in general if you had a policy that was written prior to I'm going to say 2 years ago, 3 years ago, that there's a really good chance you were silent on it and now your internal legal staff is explaining to you that a judge may find coverage where none was ever intended and you never collected premium for this and you don't have the right wording around it. So there's this race to doing it. So you'll see folks who came out with an exclusion 6 months ago and now coming out with affirmative wording today and that's not just in cyber which goes to that education word. If you're a professional insurance agent today and you're dealing with the insured, your insured is maturing every day of the week and they're getting smarter and smarter. And by the way, even if they don't know the answer, guess where they're turning to ask the question? To AI. So they're asking AI to compare three policies, they're coming to you with a list of questions and then if you're using the same AI to answer those questions and both sets of AI are hallucinating with each other, that might be called an E&O exposure. So the education, you cannot replace legitimate education on behalf of the carrier, the intermediary or wholesaler if they exist and the retail broker. Something we counted on for years is that insurance agents invest in themeselves to become smarter every day. And I think if anybody's listening to this right now, what they've just heard from Jennifer, Joe and myself is get educated. You need to know what's in there and you need to know what you're selling.

18:51 - Paul Lucas
Jennifer, I see you nodding along with Keith. Looks like you're in agreement.

18:51 - Jennifer Wilson
Yes, I thank you Paul. I agree and I think that we are overstepping important factor about this and this is not only do, you know, the brokers need to be educated and keep up and evolve along with the cyber risk, but at this point it's almost incumbent upon the insured to educate themselves and evolve along with respect to cyber insurance. Some examples that I could share is that, you know, we had a client come to us and present a quote that was $50,000 less than what we were presenting. And I had to spend time communicating back and forth with the general counsel, helping her to understand and you know, you truly get what you paid for. And there were so many critical coverages that were not captured in the much cheaper quote. And these are coverages that, you know, a sophisticated client was not aware of. So, it's almost unfair to the insured at this point, but the best way to arm them with, you know, to ensure that they are purchasing the broadest policy out there is to make them aware that they are working with a trusted, um, knowledgeable expert in the cyber space that is focused solely on cyber and negotiating it daily. Otherwise, you know, they are sitting in the seat of, you know, making investment choices with respect to insurance and not really understanding the fine print or the lack thereof.

20:09 - Paul Lucas
Really interesting insights across the board and another super discussion. Huge thanks, of course, to everyone for their time. Remember, the Leaders Network will be back together next month, so until then, keep it right here on Insurance Business TV.

20:41 - [music]