1. FAIR 2018 – Cyber Risks & Markets

2. Structure
Cyber Insurance? Why now? What has changed?
Cyber Insurance Globally / MEA region
The Coverages Available in Market
Real claims Scenario
Cyber Insurance: A service, not just a policy
Moving Forward

3. Cyber Insurance
A cyber insurance policy is a policy designed to help an organization mitigate risk exposure by offsetting costs involved with recovery after a cyber- related security breach or similar event.
Myth: Cyber Insurance covers Direct financial Loss as of a Malicious Hack. It is not to be mixed with Computer Crime.
The Cyber policy has a hybrid form as it responds to third party claims & has first party indemnification extension coverages as well.
Cyber – Why now? Changes in Laws & regulations. Notable mention: GDPR – 3%.

4. Cyber Insurance Globally
The Cyber Market is still a very niche market with penetration in US Market < 15% and <1% in other regions of world.
The global market premium is around USD 1.8 Billion with USD 1.5 Billion coming from USA – 90%. The reason being due to data breach legislation – Currently present in 47 states.
Although the penetration for non-US markets was considered low in earlier years, the landmark has recently changed significantly since the implementation of GDPR - The General Data Protection Regulation which is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) & addresses export of personal data outside the EU and EEA areas.
The Data Protection Act imposes fines ranging from 2% to 4% on companies that are found in breach of certain articles.

5. Cyber Insurance – MEA
The penetration in Middle East & Africa market for the Cyber Product has been very low in previous years compared to other countries globally. Initially, the main buyers of this cover are limited to major financial institutions (Banks) and some Hospitals.
The landscape is rapidly changing now. Although GDPR was implemented in Europe, most companies in MEA region who deal with EU states (services / products / export / import) are now required by their contracts to purchase Cyber Insurance protection.
The change in landscape does not stop at GDPR as several countries in MEA are now legislating Data laws. If we take the UAE as an example, although there is not yet a federal data protection law in place, there are a number of obligations and requirements imposed on individuals and organizations that touch upon privacy and data protection concerns.
In short, the Cyber product has become a necessity for any enterprise in order to properly mitigate from the devastating repercussions of a Cyber Hack / Data breach. We will talk in the slides to come on coverages available in market.

6. Cyber Coverages I
Security & Privacy Breach - Damages and Defense Expenses which the Insured is legally obliged to pay as a result of a Claim arising from a Security Breach or Privacy Breach.
Multimedia Liability - Damages and Defense Expenses which the Insured is legally obliged to pay as a result of a Claim arising from Multimedia Activities / Infringement / Defamation / Libel & Slander.
Business Interruption / Network Interruption - Gross Earnings and Extra Expenses incurred during the Interruption Period directly as a result of the total, or partial, or intermittent interruption or degradation in service of the Insured’s Computer System caused directly by a Privacy Breach, Security Breach.
Reputational Harm - Expenses reasonably incurred by the Insured and approved in writing in advance by the Underwriters for the employment of a public relations consultant if the Insured reasonably considers that action is needed in order to avert or mitigate a Gross Earnings or Adverse Media Event.

7. Cyber Coverages II
Digital Asset Destruction - Expenses incurred to restore or recreate Digital Assets. If it is determined that Digital Assets cannot be restored or recreated, the Underwriters will only reimburse the Insured’s losses or expenses incurred
Cyber Extortion - Extortion Expenses and Extortion Payment incurred directly as a result of a Cyber Extortion Threat.
Incident Response Expenses - Breach Response Expenses incurred as a result of a Privacy Breach or Security Breach.
Depending on Market, the insured gets access to a third party service provider Hotline. Some markets have an in-house response team whereas other markets use third parties.

8. Claim Examples Globally / MENA
Target - July Big Retailer Malware stored on Target checkout registers led to theft of data form 40 million credit and debit card accounts along with personal information form 70 million customers - Estimated Cost of incident USD 500M
Saudi Aramco - Saudi Aramco was targeted by hackers with the intent to cease the companies crude oil and gas supplies. The hard drives of 30,000 desktops and 2,000 servers were destroyed forcing the IT system to be disconnected for 2 weeks.
Bank X – Qatar – The bank was targeted by hackers and the account information for several high ranking individuals were stolen. The Hackers demanded a USD 20M ransom, otherwise the data will be disclosed.
Bank Y – Kuwait - The bank was hacked and personal information of some clients was stoles. However, the damage came form competing banks that started to advertise against the said Bank as being not secure.
Hospital Z – The hospital was hacked and denied access to their systems. The hackers demanded a ransom of USD 2M which was paid as Hospital did not have access to Medical Records of clients.

9. Cyber Insurance: A service, not just a policy.
Cyber Liability is not just a policy, but a service which companies buy.
Cyber Liability does not eliminate the Job of Internal IT managers. It compliments & mitigates risks.
It is not a question of “IF”, but more of “WHEN”.
Clients need to bear in mind that the level of premium they pay will vary depending on the level of service required. Accordingly, please do investigate. Who will pick up the phone?
The market is still soft and now is the time to purchase and/or increase limits.

10. Cyber Insurance: A service, not just a policy. (Continued)
The world is continuing its digital Revolution / transformation with no sign of slowing down.
The amount of data consumed every day by businesses is rapidly increase and companies are reliant more than ever on their data to achieve their goal.
Governments around the globe are aware of the above and legislating Data Laws in order to protect Citizens and Consumers. The fines have become painful.
Hackers have become more sophisticated in exploiting networks and software vulnerabilities
Noting the above , it is imperative for business now, more than ever, to choose a correct partner (not purchase insurance) in order to properly mitigate their risks.