As technology has grown and changed, so have customers’ expectations of their insurance programs.
When insurers hear from customers that current insurance products are not adequate for their needs, things begin to change, albeit slowly most of the time, says Graeme Newman, marketing director of London-based CFC Underwriting, a Lloyd’s-backed MGA.
Reputational risk associated with data and privacy breaches is an area interest for the industry, but finding the most efficient products to deal with this risk has left insurers scratching their heads.
“Reputational risk, by the insurance industry, is classified as an emerging risk. But let’s face it – it’s been a risk that businesses have had for centuries,” he says. “How we react to that and how we manage that is an emerging area of insurance and we’re seeing lots of insurance carriers now putting extra thought into how they can do that.”
Traditional insurance policies have covered direct financial loss from a breach such as the cost to the company for services like customer notification, credit monitoring, and data recovery efforts. Data breach policies also usually include public relations and crisis management support to tackle the immediate fallout.
But insureds have repeatedly expressed concern that these policies do not address the long-term repercussions a breach can have on their business. Now, insurers are trying to expand their policies to cover loss of future sales, which Newman says is tough for insurers to quantify.
“It’s very, very difficult to insure someone’s reputation. What is someone’s reputation worth? Traditionally, people have tried to insure that by providing them with cover for PR costs or support, with marketing or crisis management consultants. But really that’s a thin, sticky plaster on their reputation,” says Newman.
CFC has been working on this challenge and recently enhanced its cyber product to address not only the direct financial loss from an outage or security breach, but also the reputational fallout that occurs after a breach.
“We saw clients worrying about the damage to their reputation that they would experience if they had a hack attack and customers no longer trust them and wouldn’t shop with them anymore,” says Newman.
CFC’s new CPM policy is an upgrade to its flagship data and privacy coverage that includes reputational harm as a result of a security breach or system outage. The coverage gives direct protection for loss of net revenue.
Newman says the industry will have to be creative in addressing reputational risk, particularly as social media and other new technologies present situations where companies can be the victims of reputational harm.
“The damage to somebody’s reputation from even a minor event can be absolutely huge. The message can go global in a very short space of time,” says Newman.
Newman says he expects carriers to be increasingly focused on this complicated area, which will hopefully lead to new products that are more efficient and relevant to insureds. “[Reputational risk] is going to be a very big area of insurance in the next five to 10 years. It’s just how we go about assessing that, quantifying it, and paying for those damages. That’s the challenge.”