Industry facing higher bills for cyber insurance

As defined contribution sponsors try to protect plan information from cyberattacks, they are finding that cyber liability insurance is more expensive and harder to obtain or keep. At the same time, insurers are asking many more questions about plan practices and imposing greater restrictions on policies compared with just a few years ago.

"The cyber market is not treating employee benefit plans any differently" than any other business, said Daniel Aronowitz, Vienna, Va.-based principal of the insurance firm Euclid Specialty Managers LLC, which provides cyber insurance. "They are subject to the same market constraints and underwriting criteria."

Coverage premiums are up 35% to 80% from last year, said Mr, Aronowitz, adding that these increases "are across the board and apply to all cyber policies being issued."

Recent surveys by the Council of Insurance Agents & Brokers, a Washington-based trade association, show the average quarterly premium increase in cyber coverage was 27.6% in the third quarter of 2021 compared with 25.5% in the second quarter and 18.1% in the first quarter.

Industry members cite 2019 as an inflection point when rates began rising and coverage became tougher to obtain. The primary culprit was an explosion of ransomware attacks, said John Farley, New York-based managing director for cyber practice at Arthur J. Gallagher & Co., an international risk management and insurance brokerage company,

"Even the best-in-class policies for risk are seeing upwards of 50% increases" in cyber insurance premiums so far this year, Mr. Farley said. Others could expect rate increases of 100% or 200% — "if you get a quote at all," he added.

Those seeking to buy or renew cyber insurance have been challenged by the industry's limited capacity — the ability and willingness of carriers to write policies.

In the past, for example, if clients wanted $25 million in coverage, they might be able to get the coverage spread among three insurers offering as much as $10 million each, Mr. Farley said. "Now you might need more carriers to get to $25 million since each might not offer any more than $5 million," he said.

The Council of Insurance Agents & Brokers surveys say 78% of members reported a decrease in underwriting capacity for cyber insurance in the third quarter of 2021 vs. 81% in second quarter and 73% in the first quarter.

Mr. Farley said insurers are looking more closely at the cyber protection practices employed by prospective and existing clients.

"There has been a laser focus" on client protocols in recent years, he said. "If you don't have multifactor authentication, you won't get a quote."

Other best practices include having a proper data-backup source that is separate from the client's primary data source and making sure clients have a written response plan to a cyberattack, complete with names of people at the client responsible for taking action.

Insurers want to know how fast clients can get their operations running again following a cyberattack, suggesting that seven days would be essential for restoring critical data, Mr. Farley said. They also want to know how fast a client can patch a breach, at least to prevent more damage from being done after a cyberattack has been detected.

Euclid Specialty Managers sends prospective clients an eight-page cyber insurance application, but if they cannot meet four requirements, they won't get a quote, said Mr. Aronowitz. Those requirements are:

• Multifactor authentication for all remote access.
• Recovery of all "business and critical data in less than 10 days.
• Off-site and/or cloud data backups that are less than 1 month old.
• An endpoint detection and response, which refers to implementing technology that defends against ransomware, viruses, malware and other forms of cyberattacks.

Other Euclid application questions include describing any cyber event in the last three years, the cost of such an attack and what has been done to prevent future attacks. Euclid also asks if applicants conduct mandatory information security and privacy training of employees and contractors at least annually for issues such as phishing and security threat awareness.

"Underwriters want to know you are taking serious action" to prevent and mitigate cyberattacks, Mr. Aronowitz said.

Despite tougher underwriting standards, there are still gaps in cybersecurity coverage. Within the last year, "many cyber carriers are no longer providing coverage for cyber crime losses, and that could restrict coverage for stolen retirement plan funds," Mr. Aronowitz said.

"For example, many cyber policies will no longer offer coverage for social engineering fraud, computer fraud or funds transfer fraud," he added. "Plan sponsors will need to look to fill the gap for these third-party cybercrime coverages from their crime policy."

Coverage gaps for DC plans also were identified in a February report by the Government Accountability Office, which interviewed insurance industry members, other insurance experts, trade association officials and record keepers.

Eleven of 19 experts interviewed by the GAO said that cyber insurance policies "generally do not replace funds stolen from participants' accounts and frequently have provisions, such as caps on payouts or exclusions for certain types of attacks, which limit the amount of coverage for a cyber attack," the report said.

The report also said gaps in DC plan coverage may be due to how cyber insurance is purchased. Five experts told the GAO that "employers usually purchase cyber insurance for their entire enterprise, which may not be tailored to or adequate for the specific needs of a retirement plan, such as replacing stolen retirement account funds."

Mr. Aronowitz said 90% of the cyber insurance market consists of employers "purchasing cyber insurance for their entire entity, which would include the sponsored employee benefit plans." The exceptions are multiemployer plans and multiple-employer plans as well as some stand-alone plans, like church plans. "Multiemployer plans purchase cyber insurance directly for the plan itself," he said. Most public retirement plans' cyber insurance is purchased by the county, city, state or other government entity, he said.

Despite the proliferation of cyberattacks, Cerulli Associates, Boston, found that many DC plans lack cyber insurance.

In a report that will be issued next month, the research firm found that 29% of 702 DC plan sponsors surveyed in the third and fourth quarters didn't have cyber insurance, while 9% said they planned to have it within the next 12 months. Sixty-one percent have the insurance.

Cyber insurance "may not be top of mind for sponsors," said Shawn O'Brien, Boston-based senior analyst for retirement at Cerulli Associates. "I imagine cost can be prohibitive, especially for some of these smaller organizations."

The survey said the smallest plans — those with less than $25 million in assets — were the least likely to have cyber insurance. Thirty-seven percent said they didn't have it; another 12% said they would add it in the next 12 months.

For plans with assets between $25 million and $250 million, 25% said they didn't have insurance and 8% said they would add it within the next 12 months. For plans with more than $250 million in assets, the respective rates were 22% and 8%.

Those numbers belie what many DC plan sponsors have said about cyber insurance.

"In my experience, virtually every plan sponsor that we work with is aware of the need" for cyber insurance, said Ben Taylor, San Francisco-based senior vice president and defined contribution consultant at Callan LLC. "It is similarly as common to know that you need it (and) it is almost equally uncommon to know what to do about it."

Part of the challenge is determining coverage details because common terms such as "breach" can have different meanings to different insurers and law enforcement agencies, he said.

The February GAO report illustrated this dilemma. Twelve of 19 insurance and retirement plan experts interviewed by the GAO said sponsors "may not understand what their cyber policies actually cover." Sources of confusion included "lack of consistent terminology, policy types and pricing models across the cyber insurance industry," the report said.

Mr. Taylor said the retirement industry welcomes more clarity and transparency.

"Clients are very hungry for clear guidance from those who are engaged in actually creating new solutions for the industry," he said. "What has really been a challenge is providing adequate education and expertise to every plan sponsor so they can be an informed consumer."