Large-scale cyber risks: What about insurability?

Swiss companies' need for solutions against cybercrime is great and growing at a fast pace. According to the "Global Digital Trust Insights 2023" of the consulting firm PwC, 73 percent of Swiss companies see an urgent need for action in this area. With the rise of cybercrime as one of the most central top risks, the insurance gap for large-scale cyber incidents is growing nationally and internationally. Helvetia's symposium "Challenges in managing top cyber risks" on June 5, 2023, aggressively brought the acute problems into the public eye.

Hardly sufficient protection against large-scale cyber risks

"It is true that the insurance industry can cover individual risks well today - provided that companies make appropriate investments in prevention and data security," said Martin Jara, CEO of Helvetia Switzerland. "But for major events, which can go far beyond individual attacks with a large number of people affected, there is currently insufficient protection in Switzerland." The central element, he said, must be to build resilience into the Swiss SME economy: no mandatory coverage, but industry-specific prevention to allow financial compensation to continue.

"Triad of Resilience"

Alexandra Arni, Head of ICT at Swiss Banking and Vice President of the Swiss Financial Sector Cyber Security Centre (FS-CSC), explained what such an approach might look like. There, the cooperation of all parties involved is already based on the "triad of resilience," namely prevention, crisis management and damage repair. Hans-Ulrich Bigler, Director of the Swiss Trade Association (SGV), pointed out that the most important pillar of the Swiss economy, namely the approximately 600,000 SMEs, are affected by the threat of cybercriminals at least as much as large companies and operators of system-critical infrastructures. It is therefore important that SMEs deal with the risks and take prevention seriously.

Raphael Reischuk, Partner and Head of Cybersecurity at Zühlke Engineering, picked up the thread of the previous speaker. Reischuk emphatically emphasized that the insurability of cyber risks must be ensured as soon as possible for the benefit of the population, the economy and ultimately also the democratic structure of our society. Reischuk showed how the issue can be tackled technically by means of a data-based system for the real-time collection of cyber risks, which enables an improved global situation picture, promises incentives to reduce cyber risks and rewards policyholders with adaptive insurance premiums.

Administration and science support broad cooperation

The need for a solution to improve the insurability of large-scale cyber risks, as well as the bundling of different competencies and experiences, also met with an open ear among the representatives of the administration and academia present. Florian Schütz, head of the National Center for Cyber Security (NCSC) and designated director of the new Federal Office for Cyber Security, emphasized in his remarks how important the contribution of companies is for a cyber strategy in line with national values and principles. Ultimately, however, he said, the business community also has an interest in placing cybersecurity at the top of the agenda as a productivity driver. In any case, he said, on the part of the NCSC, one is pleased that the insurability of cyber risks is increasingly coming into focus. "In the context of the national discussion about increasing cyber resilience and minimizing economic damage, today is the right time to have this discussion," said Florian Schütz.

On the scientific side, industry and government can rely on the extensive know-how of specialized start-ups and national institutions such as the Swiss Federal Institute of Technology ETH. Professor Florian Tramèr, an expert in computer security, privacy protection and machine learning in the Department of Computer Science at ETH Zurich, showed how intensively science is currently addressing the topic and is already developing future-oriented models with the involvement of business and government.

Insurance industry relies on improved fundamentals and appropriate risk models

Jean-Philippe Moser, Head of Insurance Sectors at the Swiss Insurance Association (SIA), and David Ribeaud, CEO Specialty Markets at Helvetia, emphasized the industry's willingness to play its part. For example, in the effort to achieve a solid data basis and suitable risk models for better insurability of cyber attacks. At the same time, both speakers emphasized the need for improved foundations to create increased cyber resilience in the Swiss economy and society. Companies that invest in cyber security and prevention will have a better chance of obtaining appropriate insurance solutions.

Chances for political acceptance are good

And what about the political majority capability of such solutions? According to Werner Salzmann (SVP, BE), President of the Security Policy Committee of the Council of States (SiK-S), the chances are good. After all, the SiK-S has long considered the issue of cybercrime to be one of the most pressing problems in the current security situation. Any broad-based initiative from outside the political spectrum would be looked upon favorably, said the SVP politician at the cyber symposium in Bern.

Taking into account the positions presented, the SIA and the affiliated insurance companies are developing the necessary foundations in the "Cyber" working group. At a follow-up symposium, the findings will then be discussed with the players and any further steps defined. From this perspective, it is realistic to expect that Switzerland will be able to establish a realistic cooperation between the most important representatives of business, science and government within a reasonable timeframe and with the support of all parties. This would be a globally pioneering measure and a great opportunity for the business location.

Source and further information: Helvetia