Cyber risk is now in 2nd place in the ranking of emerging risks established by Axa’s “Future Risk Report”. In this context, AMRAE has published the second edition of its study LUCY (LUmière sur la CYberassurance). It emerges from many disparities in cyber risk insurance by companies.
First of all in terms of the number of companies insured. The study shows a increase in the number of ETIs insured in 2021. They now number 530, compared to 441 in 2020 (+20%). They are the only ones to observe an increase at this level. Over the same period, 40 SMEs left this traditional insurance model (from 362 to 322, -11%). A more worrying, albeit lower, figure is for large companies. Of the 251 large groups that had taken out a cyber policy in 2020, 11 have given up doing so in 2021. A figure that may seem anecdotal, but in a market that should still be growing, ” it’s a very strong signal »believes Philippe Cotelle, administrator of AMRAE and president of its Cyber commission.
The study also points out that although the costs of compensation for companies have generally decreased between 2021 and 2020, they still remain highly dependent on the impact of high-intensity claims. In 2021, six XXL claims were compensated for €90.6 million, which represents 55.6% of the total volume of compensation. ETIs, for their part, have seen their compensation tripled in one yearfrom €12.67 million in 2020 to €63.15 million in 2021. “They were able to realize that they were not immune to major disasters,” comments Philippe Cotelle.
More restrictive conditions
The study also highlights the more restrictive insurance conditions that companies had to face last year. Indeed, they found themselves confronted with a increase in premium rates (on average +100% for large companies and +56% for medium-sized companies) to which was added theintroduction of very high deductibles. “ Until now, franchises have been anecdotal, comments Philippe Cotelle. At nearly €4 million on average for large companies and €228,000 for medium-sized companies, they are now reaching considerable levels. »
At the same time, companies had to submit to much more detailed underwriting questionnaires than previously. “In itself, this is not a problem, believes Philippe Cotelle. On the contrary, we have always argued for a more technical approach to risks. But the triptych of rising rates, combined with the reduction in capacity and the tightening of underwriting conditions, ends up giving the impression that insurers no longer want to cover cyber risk. »
The self-insurance solution?
In this tight market, reinforced by a more than complicated renewal last year, can the solution for companies go through self insurance ? In any case, this is the conclusion that some seem to have drawn. Thus, solutions such as self-insurance with the captivesto manage frequency risk, or inter-company poolingto increase the level of capacity and reduce the risk of volatility linked to intensity claims, could become solutions in the future.
Finally, the last striking figure, although hardly surprising, the LUCY study shows that the vast majority of claims are of malicious origin. Accidents are the cause of only 5.5% of claims and barely represent 4% of compensation. These compensations essentially cover operating losses. The loss of personal data, which is very heavily compensated in the United States, represents in France only 4% of the cost of claims.