- LATEST BLOG POST
- echo $post_date ?>
- A recent report by Blue Hill Research discusses the Key differentiators in Governance Risk and Compliance (GRC) landscape. The report…
- Read More
Is Cyber Insurance the best tool to preserve corporate value? That is indeed an appropriate question to ask as Cyber attacks seem to constitute major threats to businesses today.
Cyber liability policies exist to indemnify and cover losses which may generate under an attack. However they generally include numerous exclusions and conditions.
Contrary to natural hazards and many “classic” hazards the frequency of cyber attacks can be/is very high. Consider for example:
Also, a well designed and executed cyber attacks may go undetected for months or years. When detected it may very difficult to evaluate its effects. Swisscom, the telecom company from Switzerland underwent such an attack as recently revealed in the media.
The multitude of attacks, from different directions and “enemies”, using techniques going from sophisticated IT to social engineering lead to complex multidimensional consequences, hence complex risk landscapes.
That’s not big news as over time we have shown that most “accidents” lead to combinations of:
In the Swisscom case we are also seeing activism being generated under the form of “invitation to write a request for information and damages“.
Accordingly, cyber liability policies cover losses up to a clients’ defined amount. Considered losses may include:
However, as indicated earlier, coverage generally includes numerous significant conditions and exclusions.
Furthermore difficulties may arise if the insured cannot monetize the value of data loss.
It becomes obvious that cyber insurance alone cannot preserve corporate value due to its own necessary limitations, designed to protect the insurer.
It is also obvious that IT alone can’t do that either as risks arise from system’s elements that can be far removed from IT. For example: the best way to crash a computer remains pulling the plug or cutting the network cable… and in the Swisscom case cited above subcontractors vulnerabilities were exploited.
So, it all boils down to risk-based decision-making support for mitigation that most often will not be IT based, but “holistic” in nature. Audits and checks cannot solve this type of problems.
What is needed is a 360 risk management approach based on convergent, scalable, updatable and drillable multi-hazard risk assessment. That’s the only way to avoid capex squandering and promote reasonable operational, tactical and strategic planning.
Reasonable planning should also allow for interesting discussions with the insurers in order to find win-win solutions around excessive exclusions, denials and conditions.
Riskope use our “universal” platform called ORE (Optimum Risk Estimates, © Oboni Riskope Associates Inc., 2014-*) to perform the risk assessments required by cyber aware companies.
Ore follows a continuous loop as shown below in Fig. 1.
Figure 1 ORE continuous loop of holistic quantitative risk assessment.
Figure 2 Dashboard of holistic risks for a M&A (real example, confidential client).
We have developed ORE over the last few decades. ORE allows to include uncertainties, inter-dependencies, societal and corporate risk tolerance and is ISO31000 compatible. ORE makes it possible to communicate risks to management and the public thanks to very clear and explicit graphic dashboards (Fig. 2, prior page).
Figure 3 displays holistic, quantitative corporate risks in a probability-consequence quadrant. The graph shows in horizontal aggregate losses C (M$) from various corporate risk scenarios including cyber hazards. The respective annual probabilities p are in the vertical axis.
For the sake of graphic simplification we have omitted the uncertainties. Some risks display as a dot (at their centroid), but should really appear as “bubbles” due to their respective uncertainties in p,C.
In the graph (Fig. 3) you see three groups of risks:
Figure 3 A real life holistic, quantitative corporate p-C graph with three families of risks: tolerable (blue), intolerable but manageable (yellow), intolerable and unmanageable (red), hence strategic.
It is easy and self-evident how to further split the regions of this graph, or select risks to compose insurance-bundles to cover the needs of a specific client.
That bundle is also designed specifically for a captive insurance program.
Conceptually risk transfers would shift the initial tolerance towards the right.
Thus the applying ORE quantitative risk assessment also allows to evaluate rational coverage for specific risks, captives greatly facilitating the search for win-win rational solutions.
It is interesting to note that ORE is always scalable, drillable and can accommodate increasing level of information during corporate/project life, if necessary in “real time”.
This is particularly interesting when initial (actuarial) data are scarce or nonexistent and we need to rely on ample use of probabilities.
Contact us to learn more.