Summary
In mid-2020, a US-based higher education institution was approaching renewal for its cyber insurance policy for 2021. Cyber insurance pricing generally was increasing rapidly at the time due to increases in the frequency and severity of losses, particularly due to ransomware attacks.
The incumbent insurer was not only set to increase pricing, but to change the policy terms and conditions, which made the client question the value of cyber insurance and had it considering dropping coverage. The institution contacted AWS Partner Marsh LLC, which aggressively marketed the program, ultimately securing more favorable coverage than the incumbent had offered.
Insurers scrutinize cyber controls in place
For 2020, the higher education institution had a US$20 million standalone cyber insurance program in place, which was led by a US$10 million line from one of the leading cyber insurers. It also had a US$250,000 self-insured retention (SIR). The cyber insurance market was entering a period of rapidly rising pricing due to an uptick in losses. Underwriters were thus scrutinizing insurance applications to a higher degree than had previously been the case.
Particular attention was being given to the cybersecurity controls clients had in place. The then-current primary insurer on the higher education institution’s program felt the institution was deficient in some control areas. For the upcoming 2021 renewal, the insurer said it would only offer US$3 million primary coverage with a US$2.5 million SIR or US$5 million with a US$10 million SIR.
Expanding discussions in the market
The higher education client approached Marsh for advice and was leaning toward not renewing its cyber insurance coverage at all. Marsh marketed the institution’s program widely, attracting more than 40 insurers to the underwriting call. None of the new market participants offered to place the primary coverage.
Marsh engaged in further discussions with some markets, which led another to offer to write the primary coverage at US$5 million, with 10% co-insurance and a US$1 million SIR. The higher education institution continued leaning toward not renewing its cyber coverage but agreed to listen to Marsh’s deeper explanation of the new offer.
Specialists from Marsh explained the financial value of having a risk transfer program in place as opposed to retaining all of the risks on the balance sheet. Marsh also explained to the client the logistics of how the co-insurance would work, and the maximum out-of-pocket expenses the client might have to bear.
Conclusion
Marsh was able to market the higher education client’s program to a large number of insurers, ultimately finding some choices that aligned with its needs.
Discussions along the way also helped the client better understand the changes it could make to the program structure, as well as cyber controls it should in place to appear as a better risk to insurers in the future. This is but one way in which Marsh’s cyber specialists help businesses manage the risks of a digitized world.
About Marsh
Marsh is part of Marsh McLennan, the world’s leading insurance broker and risk advisor. Marsh’s Cyber Practice helps corporate and public sector clients navigate an increasingly dynamic environment for cyber risks. We have a deep understanding of cyber risk and insurance issues, having been engaged with cyber insurance since its inception some 25 years ago. We work with clients to analyze their risk exposures and help them implement solutions to address and mitigate the financial impact of a cyber incident.
