WEBVTT
00:00:08.160 --> 00:00:11.839
Welcome to Maximum Exposure, the Emerging Risks Podcast.
00:00:12.160 --> 00:00:24.399
In episode eight, John Guy is joined by CFC's global head of cyber, James Burns, to discuss how cyber insurance is fast becoming mainstream as risks and recognition increase.
00:00:35.679 --> 00:00:44.880
And we are here to talk really about the current situation in terms of not only the risks but also the response from the insurance market.
00:00:45.200 --> 00:00:46.000
Welcome, James.
00:00:46.079 --> 00:00:47.679
It's a pleasure to have you on board.
00:00:48.719 --> 00:01:02.240
What I was going to say is I suppose in a way, if we look at the sort of um spectra in the room, a lot of the talk recently has been around AI and those new developments in the risk landscape.
00:01:02.399 --> 00:01:05.439
But from your point of view, how are you, how do you see it?
00:01:06.799 --> 00:01:07.439
Thanks, John.
00:01:07.519 --> 00:01:09.120
It's um yeah, yeah, great to be here.
00:01:09.200 --> 00:01:10.159
Thanks for having me.
00:01:10.319 --> 00:01:13.760
Um I think I think there's two ways of of looking at AI.
00:01:14.239 --> 00:01:32.239
One, um, you can look at it as transformational, and it there's there's no doubt that it is, AI is a transformational technology, both in terms of um how many organizations that it is impacting and will end up impacting, and also in terms of the level of impact that it will have.
00:01:32.480 --> 00:01:47.200
So in the past eight year, 18 months, two years, we've seen AI, AI really transition from being a theoretical sounding buzzword to being a practical reality that all types of organizations are having to get to grips with.
00:01:47.359 --> 00:01:49.439
And that's including us in the insurance industry.
00:01:49.599 --> 00:01:52.560
So we're we're now using AI extensively at CFC.
00:01:52.719 --> 00:01:55.840
Lots of our brokers use AI, lots of our policyholders use AI.
00:01:56.079 --> 00:02:01.439
So that's that's one way of looking at it, this sort of game-changing technological development.
00:02:01.599 --> 00:02:10.479
I think another way of looking at it is as simply the next latest step in technological evolution.
00:02:10.719 --> 00:02:24.319
So it is a big technological change, but the last 30 years have seen a series of big technological changes, all of which have increased risk, particularly cyber risk, to one degree or another.
00:02:24.479 --> 00:02:39.520
So you go back to the very early 2000s, and we have the proliferation of broadband, uh, broadband internet um, you know, came along and it connected the world, uh, but also connected attackers to millions of new potential victims.
00:02:39.759 --> 00:02:48.080
Same sort of era, you've got the the widespread adoption of email, one of one of the biggest transformations that the business world's ever seen.
00:02:48.159 --> 00:02:57.199
You know, we we take it for granted, but that was a truly transformational um piece of technology, email, um, and an enduring one at that.
00:02:57.360 --> 00:03:02.879
But it also industrialized social engineering on a scale that we've never seen before.
00:03:03.120 --> 00:03:08.639
Um, more recently, we saw the global switch to remote working from around 2020 onwards.
00:03:08.960 --> 00:03:17.439
Huge change in terms of sort of technology and operationalization of business, but it also massively increased the attack service.
00:03:17.840 --> 00:03:23.039
That was probably the largest single driver of ransomware attack frequency that we've seen historically.
00:03:23.280 --> 00:03:34.400
So AI is sort of the latest in a series of big changes, and it might turn out to be bigger than all of these, it might not, but it is still the latest change in a series of changes.
00:03:34.560 --> 00:03:41.759
And these are changes that the insurance industry, the security industry have a track record of responding to and adapting to.
00:03:41.919 --> 00:03:44.719
So that's not to say that we should be complacent at all.
00:03:44.879 --> 00:03:53.280
We do need to recognise how big a change this is and this could be, but we do need to be balanced and I think we do need to be measured in in how we respond to it.
00:03:54.000 --> 00:03:54.960
I suppose that's the thing.
00:03:55.039 --> 00:04:13.360
I I suppose one of the biggest issues around, I suppose, is that is is working with your clients to just sort of manage their manage their expectations and I suppose manage their concerns around the impact that AI might have on their uh on their exposures.
00:04:15.039 --> 00:04:16.160
Yeah, absolutely.
00:04:16.319 --> 00:04:23.279
I mean, AI is already massively changing the way that cyber criminals attack and and steal information.
00:04:23.519 --> 00:04:45.600
There are new tools at the disposal of threat actors, um, which AI has enabled, you know, deep fake technology, um, AI-powered malware, um, much more intelligent social engineering systems, and these are all obviously key concerns for um policyholders and and customers.
00:04:45.759 --> 00:04:57.199
Advanced AI models, you know, a lot of talk about mythos a few months back in the in the news, also make identifying and compromising vulnerabilities quicker, easier, and cheaper.
00:04:57.360 --> 00:05:09.920
Um, what's interesting, I think, is that, and the sort of conversations we're having with brokers and clients is that what we haven't really seen develop is any brand new areas of cyber risk arising out of AI.
00:05:10.079 --> 00:05:15.199
Um, we haven't seen any, and by that, I mean we haven't seen any cyber exposures that didn't really already exist.
00:05:15.360 --> 00:05:24.639
What we're seeing is AI and what we're expecting to see is AI acting as an amplifier of cyber exposures that already existed and were already there.
00:05:24.959 --> 00:05:39.519
Um we also haven't seen a meaningful enough shift in claims experience yet, I think, to warrant meaningful shifts in appetite or pricing when it comes to AI as a market.
00:05:39.759 --> 00:05:42.639
And lots of this will be quite um covert.
00:05:42.800 --> 00:06:08.160
You know, I think that whilst AI is going to be a big transformational shift and is a big transformational shift, the way that we feel the impact of that in terms of the risk that businesses face and the way the industry um responds could be a slower um sort of rollout because AI and the technology is changing quickly, but the rate at which businesses utilize it and adopt it is changing at different paces.
00:06:08.480 --> 00:06:15.040
So we just need to continue to make sure that we're there for our policyholders, we're there for our customers.
00:06:15.279 --> 00:06:27.519
And in my mind, the role of the insurance market should be to really lean into these challenges, to provide certainty to our customers that we we can cover them for these new types of risks as and when they emerge.
00:06:28.000 --> 00:06:29.600
I mean, I suppose that's the thing, isn't it?
00:06:29.759 --> 00:06:42.079
And you know, if you look at it, um there are some that say sort of market conditions and obviously the recent very high profile attacks, not only in the UK, we had Jaguar Landrover, Mark Suspencer's, but across the world.
00:06:42.160 --> 00:06:53.519
I mean, we've seen, you know, we saw Asahi in um in Japan, where obviously they were they were days away from running out of their favourite beer, which was which obviously the Japanese were not exactly happy about.
00:06:53.680 --> 00:07:02.639
But um, I mean, on a smaller scale, I mean, do we think these attacks now have sort of almost created a tipping point for uh for SMEs?
00:07:03.600 --> 00:07:06.240
Yeah, yes, I I do.
00:07:06.319 --> 00:07:18.959
So, and I think it's interesting that that you mentioned the Asahi uh sort of beer example, slightly tongue-in-cheek, but it it does also bring the reality home of what what what these cyber attacks mean.
00:07:19.120 --> 00:07:29.360
So we've seen a significant increase in demand for cyber insurance um among SMEs in particular over the course of the past 12 months.
00:07:29.519 --> 00:07:35.279
And um that is in in in no small part being driven by high high-profile attacks.
00:07:35.519 --> 00:07:43.519
So um last year in the UK, just over 12 months ago, we saw um MS, a number of other other big high street brands get hit.
00:07:43.600 --> 00:07:52.639
Towards the end of the year in the UK, we saw JLR, the Sahi um event, which got sort of global um coverage, as you mentioned.
00:07:52.800 --> 00:07:57.040
And these attacks all brought cyber home as a real operational threat.
00:07:57.120 --> 00:08:10.800
And I think they they were different from the types of high-profile attack we saw in the past, in that a lot of the historic high-profile attacks we saw were more data breaches.
00:08:11.199 --> 00:08:24.879
And I think SMEs and I think SMEs in particular always struggled to resonate with big data breach-only events because you know SMEs don't tend to hold lots and lots of data.
00:08:25.040 --> 00:08:36.159
But it was different about the likes of um JLR, MNS, even the Sahase you mentioned, is that these had real operational impacts that customers of these organizations felt and could see.
00:08:36.639 --> 00:08:42.480
And that made the exposure hit home harder for um everyday businesses.
00:08:42.559 --> 00:08:49.600
Um, but it also made you know lots of brokers who perhaps weren't necessarily engaging their clients on cyber risk.
00:08:49.919 --> 00:08:56.159
Um, it gave them a big incentive to start talking about this because suddenly cyber was becoming real.
00:08:56.480 --> 00:09:01.200
Um, so absolutely, those high-profile attacks um helped a lot.
00:09:01.279 --> 00:09:05.120
And that tipping point has come also in part, I think, due to market conditions.
00:09:05.279 --> 00:09:15.519
So um we've seen pricing soften both in the cyber market and the broader insurance market, and that's meant that products, cyber products have become more accessible.
00:09:15.600 --> 00:09:23.679
Um, as I mentioned, both for new buyers who who perhaps weren't able to consider it before, but also for new brokers who weren't previously pushing it.
00:09:23.759 --> 00:09:31.279
Um, the market conditions combined with that the high profile nature of some of these events is has really increased that demand.
00:09:31.919 --> 00:09:47.279
Because it actually, to be quite honest, I suppose in Hawaii leads very nicely onto what you know the role that insurance um is and could play as as you know the awareness rises.
00:09:47.440 --> 00:09:58.879
But I suppose in Hawaii, um you know um it's one of these things I suppose we we still have that, you know, we still have that protection gap in some areas of of the market.
00:09:59.279 --> 00:10:03.840
But I think you know, I think we all agree that the brokers are going to be quite key.
00:10:04.000 --> 00:10:11.600
I think the brokers will be quite key on how how how we can how we can sort of address that protection gap.
00:10:12.480 --> 00:10:19.519
Yeah, I mean brokers aren't just key, they're they're fundamental, I think, to to the um to the success of this this product.
00:10:19.679 --> 00:10:28.320
So I think I think the valuation, sorry, I think the value proposition of cyber, you know, as a as a product, is it a valuable insurance product?
00:10:28.480 --> 00:10:30.480
I think that's been that's been proven out.
00:10:30.559 --> 00:10:36.399
I think you know, hundreds of thousands, if not more, businesses buy this product every year, and it works.
00:10:36.639 --> 00:10:43.919
So cyber insurance responds to tens of thousands of incidents and pays billions in claims every year now.
00:10:44.080 --> 00:10:50.559
So we do have a product that we know works for the customers and it's providing value for the customers that buy it.
00:10:50.720 --> 00:10:59.279
So the product works and businesses need it, and the conditions needed for increasing adoption in terms of sort of the pricing cycle, I think, are improving.
00:10:59.679 --> 00:11:07.519
Um what we now need to do is is up the ante and really sort of increase our focus on that education piece.
00:11:07.840 --> 00:11:14.639
Businesses know that cyber risk is a top threat, that awareness has developed quite a lot in recent times.
00:11:14.879 --> 00:11:19.200
I I think what they what they don't all know is that insurance can help.
00:11:19.440 --> 00:11:29.440
So most businesses assume a cyber risk requires a security solution, and of course it does in part, but more fundamentally it is a business risk.
00:11:29.600 --> 00:11:37.360
The risk is operational, it's reputational, it's financial, and those are risks that insurance is there to protect against.
00:11:37.519 --> 00:11:50.000
Now, a good cyber insurance product will provide security services as part of that proposition, but cyber insurance is about protecting the business as a whole, not just the security vulnerabilities that exist within it.
00:11:50.159 --> 00:11:55.039
So, as an industry, we need to get much better at articulating that.
00:11:55.279 --> 00:12:00.399
And brokers are fundamental to that cause because this is what brokers do.
00:12:00.559 --> 00:12:07.440
They talk to businesses about their risk and they provide them solutions that can help mitigate and transfer that risk.
00:12:07.519 --> 00:12:13.600
Um, and that's where, as an industry, we need to support brokers to start doing that even more effectively than they were before.
00:12:13.919 --> 00:12:33.679
I suppose, in a way, um, it really is a case of potentially, I suppose, brokers really need, you know, when they are, you know, really from their point of view now, it's a case of when we're sitting down with our clients and we're looking at their property risk, we're looking at their sort of you know, EL, you know, approvals liability risk.
00:12:33.840 --> 00:12:40.559
We should be to, you know, we should actually be in a situation where so you know the word cyber comes up in every conversation.
00:12:41.679 --> 00:12:42.639
Yeah, absolutely.
00:12:42.720 --> 00:12:57.519
And I think um where where we where the market has succeeded um is where I think we've seen particularly some of the larger global brokers, uh, maybe some of the larger national brokers, they've set up sort of specialist cyber divisions within their within their operations.
00:12:57.679 --> 00:13:05.600
So they've got that specialism in-house and they've been able to, you know, um stimulate growth that way and had a lot of success that way.
00:13:05.919 --> 00:13:18.240
What we need is we need to get to the point where every broker, because because cyber shouldn't be a specialist class of business, cyber should be as ubiquitously purchased as property insurance.
00:13:18.399 --> 00:13:24.320
It you know, it is it is the sort of property of the 21st century and the crime policy of the 21st century.
00:13:24.399 --> 00:13:29.360
The assets that we value today are intangible assets, they're software assets.
00:13:29.600 --> 00:13:38.159
So cyber should be being talked about by every broker to every client, not just by cyber specialists at the big brokers to the big clients.
00:13:38.480 --> 00:14:01.840
And um, you're absolutely right, from that perspective, we need to get brokers who um perhaps trade four or five different lines of cover and they're having renewal meetings with their clients to talk about property, um, to talk about you know public liability, to talk about other lines of coverage, feeling comfortable and confident that they can start talking to those clients about cyber risk.
00:14:02.000 --> 00:14:15.440
And I think we as cyber insurers, particularly, you know, specialist cyber insurers include ourselves in that, um, have real responsibility to get that education out to the brokers and support them in delivering that message and growing this market.
00:14:15.840 --> 00:14:17.519
I suppose that's one of the key issues, isn't it?
00:14:17.679 --> 00:14:25.360
I mean, there's a there is an education piece really, both for for the the brokers and also the client.
00:14:25.519 --> 00:14:34.080
Um, because things as you know as we've touched on earlier, I mean, you know, the the you know, cyber risks are rarely out of the headlines now.
00:14:34.240 --> 00:14:35.600
I mean, they they really aren't.
00:14:35.679 --> 00:14:50.960
I mean, and of course, there's a there's been a lot of work done by the UK government and obviously governments around the world to to highlight the fact that this is now you know a fundamental, it's actually a fundamental risk to you know, sort of GDP and and and in fact national security.
00:14:51.120 --> 00:15:13.360
Um so I suppose in a way it's it's it's what you know that education and I suppose access to access to the products will be one of the uh you know our two of the probably the the the big hurdles we now need to spend you know the the coming you know the coming months um looking to uh to overcome.
00:15:14.240 --> 00:15:15.840
Yeah, absolutely.
00:15:16.080 --> 00:15:23.679
And the um the sort of the high profile attacks are sort of one part of the the um the equation, you know.
00:15:23.759 --> 00:15:42.720
They they they sort of that they bring the awareness and they perhaps make the conversation easier to to raise for brokers and um for for you know they perhaps prime customers' clients to be more um uh receptive to those conversations.
00:15:42.879 --> 00:15:54.320
But then it's not always easy to to link a big high-profile event um that's happened to um the client that sat in front of you who might be a small business.
00:15:54.559 --> 00:16:06.639
It's not easy to link that event happening to why that client sat in front of you should buy a cyber insurance policy and what their specific needs and exposures are from a cyber perspective.
00:16:06.879 --> 00:16:09.600
So um, yeah, we're very conscious of that.
00:16:09.679 --> 00:16:17.679
We're conscious that brokers need tools to help make sure that they are equipped to have those conversations with their clients.
00:16:18.000 --> 00:16:43.200
We launched a um a series called um Masterclass um relatively recently, where brokers can upskill um their cyber knowledge and not just in relation to the technical side of what cyber is and how it works, but also the nature of conversations that might unravel with clients, sort of objections that they might face from small businesses who don't think cyber is relevant to them.
00:16:43.600 --> 00:16:57.440
Um, you know, these are the sorts of educational pieces that are really, really useful in giving the comfort and the confidence for brokers that haven't spoken about this class of business before to start raising it.
00:16:57.519 --> 00:17:12.000
Um, and then there are tools that we've got that can help brokers in terms of passing that information on to the client to let them see why they do need to take cyber exposure seriously and how cyber insurance can help in response to that.
00:17:12.240 --> 00:17:25.839
So, yeah, the awareness is one part, the education is another, making that education specific to the client that these brokers are speaking to, that's a really important part of the puzzle as well, because it needs to feel tailored, and that's how we know it has the biggest impact.
00:17:26.079 --> 00:17:27.680
I mean, that's the thing, James, isn't it?
00:17:27.839 --> 00:17:32.960
I mean, yeah, I think brokers are by their very nature entrepreneurial.
00:17:33.039 --> 00:17:43.440
They're you know, from their point of view, they're always, you know, their business is you know, their business is is is you know sort of looking at how they can drive both innovation and growth.
00:17:43.680 --> 00:17:52.559
Um, are you finding that, and again, as you say, you know, you're running the master classes, you've got a number of sort of educational issues out there open to brokers.
00:17:52.880 --> 00:17:56.720
Are you finding that increasing number of brokers now are actually coming to you?
00:17:56.799 --> 00:18:11.200
Because I suppose the big issue is the conversation has to be had where the brokers turn around and saying, Well, actually, James, hand on heart, I'm not too confident about, you know, I'm not too confident about discussing what you offer and where it fits with my clients.
00:18:11.440 --> 00:18:12.319
How can you help me?
00:18:12.400 --> 00:18:43.039
Are are you seeing more brokers now sort of being, you know, in a way being sort of honest and saying, look, we see the opportunity, but can you help us in and how we how we can sort of um you know sort of um express this to the client and and also um look at how they can, you know, look at how the client should you know or sort of express to the client their needs and how how the insurance market plays that part in in that sort of great greater cyber resilience.
00:18:44.079 --> 00:18:45.599
Yeah, no, absolutely have.
00:18:46.000 --> 00:18:52.640
We've seen that that hunger and that desire um to engage more with cyber and to learn more from brokers.
00:18:52.799 --> 00:18:57.759
Um I think we we launched our masterclass program um around the middle of last year.
00:18:58.000 --> 00:19:08.799
We've had well over 5,000 individual brokers um register and begin the masterclass training modules, which is you know fantastic.
00:19:08.880 --> 00:19:31.519
We we didn't foresee that level of engagement that quickly amongst our broker base, and I think that's a really strong signal that brokers are you know hungry for um content and education and material that can help making have this conversation more comfortable and help them be more confident in having the conversation.
00:19:31.680 --> 00:19:52.319
A big part of the focus with our content is in simplifying and demystifying this topic because I think what our industry has been quite guilty of in the past is um perhaps overintellectualizing um cyber as a topic in certain respects.
00:19:52.559 --> 00:19:57.359
Um, you know, it's a it's a technically it's a technical sounding risk.
00:19:57.519 --> 00:20:12.160
Um, the nature of cyber attacks and cyber threats, you know, that it's intangible by nature, it's not like property where you can sort of see, smell, feel, touch the exposure uh and the nature of what you're insuring.
00:20:12.240 --> 00:20:17.920
Uh, and I think that can make it seem a bit less accessible to lots of people.
00:20:18.240 --> 00:20:31.519
And, you know, in our in our minds, the way to overcome that is not to try and overcomplicate it, it's to try and simplify it because ultimately what we're still talking about is insurance.
00:20:31.680 --> 00:20:39.200
You're you know, customers have a set of assets which are valuable to them and they want to protect those assets.
00:20:39.359 --> 00:20:40.960
That's what this boils down to.
00:20:41.119 --> 00:20:46.079
It just happens that in the case of cyber, the the assets tend to be intangible.
00:20:46.160 --> 00:20:59.359
Um, the threat actors you tend to not be able to see, um, and there's often you know it might be quite difficult to understand exactly how these attacks occur, but fundamentally there's an asset that needs protecting.
00:20:59.440 --> 00:21:06.160
And when you start boiling it down to that, um, it suddenly all becomes much clearer, much easier to understand.
00:21:06.240 --> 00:21:21.119
And I think brokers appreciate you know, having content and um literature that that really tries to demystify and simplify as opposed to overcomplicate because this subject is too important to overcomplicate.
00:21:21.279 --> 00:21:25.759
We need we need cybers go mainstream, and we need brokers to help us do that.
00:21:26.079 --> 00:21:41.519
That comes to sort of the last question I was actually um as you were talking, was thinking about how how confident are you that the market is going to be able to, and you've put it very succinctly, move cyber insurance into the mainstream?
00:21:42.240 --> 00:21:43.599
I'm very confident.
00:21:43.759 --> 00:21:50.240
Um, you know, as I said before, I think the the value proposition of cyber has been proven out.
00:21:50.400 --> 00:22:01.359
Um, there are hundreds of thousands of organizations of all sizes in all industry verticals already purchasing and getting use out of this product.
00:22:01.599 --> 00:22:14.000
Um, you know, we see the um the good that cyber insurance does when um an insured is having their worst potential day possible.
00:22:14.160 --> 00:22:27.200
You know, their systems are hosed, they can't service their customers, they're staring down the barrel of serious financial um jeopardy, a cyber insurance policy is an absolute lifeline.
00:22:27.359 --> 00:22:36.880
And the fact that we see that happen tens of thousands of times on an annual basis now means that there is immense value in cyber insurance.
00:22:37.039 --> 00:22:57.119
And like I said, if um over the next, you know, I think what the last 12 months in particular and what we'll see over the course of the next few years is that if we can make access to that product easier for uh brokers and customers, um then I've no doubt that we'll see penetration of this product continue to continue to surge.
00:22:58.319 --> 00:23:02.799
James, that's that's super and um I've thoroughly enjoyed our conversation.
00:23:02.880 --> 00:23:05.119
Um it's been more than informative.
00:23:05.279 --> 00:23:32.720
I mean, and and and it's as you say, it's quite nice to actually get beneath the headlines because as I said, a lot of the time, a lot of the time what you tend to see is is the you know, it's when things go wrong, and it's actually it's a it's you know, I think that the the message I think the market really needs to go at is actually we're here to you know we're here it's more around resilience as well as it is disaster recovery, shall we say.
00:23:32.880 --> 00:23:39.359
You know, if we can it's far better to to prevent than than you know reparate, really.
00:23:39.519 --> 00:23:53.359
Um and it's uh as I said it's fascinating, I'm sure with the greatest respect, and I hope you'll you'll agree this is uh I'm sure we'll talk again because I'm you know this is this is a you know this is a topic that um that is gonna run and run.
00:23:53.440 --> 00:24:12.000
And I I think uh you know, with as we were saying, you know, with the implementation of more technology in the workplace and and in the home, um, you know, uh I think we are gonna be in a situation where the the cyber market is is is set to be mainstream and some, I think, in the in the in the years to come.
00:24:12.240 --> 00:24:24.160
Yeah, I I couldn't agree more and um yeah, we're we're we're very excited about where this market's going and working with our broker partners to to make sure their clients are getting the protection they need.
00:24:24.240 --> 00:24:28.240
And yeah, I'd be more than happy to come back and talk more on this topic, John.
00:24:28.559 --> 00:24:28.960
Brilliant.
00:24:29.039 --> 00:24:29.680
Thank you, Jones.
00:24:29.759 --> 00:24:30.640
I really appreciate it.
00:24:30.799 --> 00:24:31.599
Thank you.
00:24:33.200 --> 00:24:41.920
Thank you for listening to Maximum Exposure, Talking Emerging Risks, a new series of podcasts brought to you by emergingrisks.co.uk.
00:24:42.799 --> 00:24:53.599
We are a dedicated publication looking at the future of risk, delivering insightful news and cogent analysis on the key emerging topics facing the market in these turbulent times.
00:24:53.920 --> 00:25:08.480
With over 150,000 impressions every month, Emerging Risks has now established itself as the go to read for all those concerned with the latest analysis and trends in a dynamic and fast moving risk environment.
00:00:08.160 --> 00:00:11.839
Welcome to Maximum Exposure, the Emerging Risks Podcast.
00:00:12.160 --> 00:00:24.399
In episode eight, John Guy is joined by CFC's global head of cyber, James Burns, to discuss how cyber insurance is fast becoming mainstream as risks and recognition increase.
00:00:35.679 --> 00:00:44.880
And we are here to talk really about the current situation in terms of not only the risks but also the response from the insurance market.
00:00:45.200 --> 00:00:46.000
Welcome, James.
00:00:46.079 --> 00:00:47.679
It's a pleasure to have you on board.
00:00:48.719 --> 00:01:02.240
What I was going to say is I suppose in a way, if we look at the sort of um spectra in the room, a lot of the talk recently has been around AI and those new developments in the risk landscape.
00:01:02.399 --> 00:01:05.439
But from your point of view, how are you, how do you see it?
00:01:06.799 --> 00:01:07.439
Thanks, John.
00:01:07.519 --> 00:01:09.120
It's um yeah, yeah, great to be here.
00:01:09.200 --> 00:01:10.159
Thanks for having me.
00:01:10.319 --> 00:01:13.760
Um I think I think there's two ways of of looking at AI.
00:01:14.239 --> 00:01:32.239
One, um, you can look at it as transformational, and it there's there's no doubt that it is, AI is a transformational technology, both in terms of um how many organizations that it is impacting and will end up impacting, and also in terms of the level of impact that it will have.
00:01:32.480 --> 00:01:47.200
So in the past eight year, 18 months, two years, we've seen AI, AI really transition from being a theoretical sounding buzzword to being a practical reality that all types of organizations are having to get to grips with.
00:01:47.359 --> 00:01:49.439
And that's including us in the insurance industry.
00:01:49.599 --> 00:01:52.560
So we're we're now using AI extensively at CFC.
00:01:52.719 --> 00:01:55.840
Lots of our brokers use AI, lots of our policyholders use AI.
00:01:56.079 --> 00:02:01.439
So that's that's one way of looking at it, this sort of game-changing technological development.
00:02:01.599 --> 00:02:10.479
I think another way of looking at it is as simply the next latest step in technological evolution.
00:02:10.719 --> 00:02:24.319
So it is a big technological change, but the last 30 years have seen a series of big technological changes, all of which have increased risk, particularly cyber risk, to one degree or another.
00:02:24.479 --> 00:02:39.520
So you go back to the very early 2000s, and we have the proliferation of broadband, uh, broadband internet um, you know, came along and it connected the world, uh, but also connected attackers to millions of new potential victims.
00:02:39.759 --> 00:02:48.080
Same sort of era, you've got the the widespread adoption of email, one of one of the biggest transformations that the business world's ever seen.
00:02:48.159 --> 00:02:57.199
You know, we we take it for granted, but that was a truly transformational um piece of technology, email, um, and an enduring one at that.
00:02:57.360 --> 00:03:02.879
But it also industrialized social engineering on a scale that we've never seen before.
00:03:03.120 --> 00:03:08.639
Um, more recently, we saw the global switch to remote working from around 2020 onwards.
00:03:08.960 --> 00:03:17.439
Huge change in terms of sort of technology and operationalization of business, but it also massively increased the attack service.
00:03:17.840 --> 00:03:23.039
That was probably the largest single driver of ransomware attack frequency that we've seen historically.
00:03:23.280 --> 00:03:34.400
So AI is sort of the latest in a series of big changes, and it might turn out to be bigger than all of these, it might not, but it is still the latest change in a series of changes.
00:03:34.560 --> 00:03:41.759
And these are changes that the insurance industry, the security industry have a track record of responding to and adapting to.
00:03:41.919 --> 00:03:44.719
So that's not to say that we should be complacent at all.
00:03:44.879 --> 00:03:53.280
We do need to recognise how big a change this is and this could be, but we do need to be balanced and I think we do need to be measured in in how we respond to it.
00:03:54.000 --> 00:03:54.960
I suppose that's the thing.
00:03:55.039 --> 00:04:13.360
I I suppose one of the biggest issues around, I suppose, is that is is working with your clients to just sort of manage their manage their expectations and I suppose manage their concerns around the impact that AI might have on their uh on their exposures.
00:04:15.039 --> 00:04:16.160
Yeah, absolutely.
00:04:16.319 --> 00:04:23.279
I mean, AI is already massively changing the way that cyber criminals attack and and steal information.
00:04:23.519 --> 00:04:45.600
There are new tools at the disposal of threat actors, um, which AI has enabled, you know, deep fake technology, um, AI-powered malware, um, much more intelligent social engineering systems, and these are all obviously key concerns for um policyholders and and customers.
00:04:45.759 --> 00:04:57.199
Advanced AI models, you know, a lot of talk about mythos a few months back in the in the news, also make identifying and compromising vulnerabilities quicker, easier, and cheaper.
00:04:57.360 --> 00:05:09.920
Um, what's interesting, I think, is that, and the sort of conversations we're having with brokers and clients is that what we haven't really seen develop is any brand new areas of cyber risk arising out of AI.
00:05:10.079 --> 00:05:15.199
Um, we haven't seen any, and by that, I mean we haven't seen any cyber exposures that didn't really already exist.
00:05:15.360 --> 00:05:24.639
What we're seeing is AI and what we're expecting to see is AI acting as an amplifier of cyber exposures that already existed and were already there.
00:05:24.959 --> 00:05:39.519
Um we also haven't seen a meaningful enough shift in claims experience yet, I think, to warrant meaningful shifts in appetite or pricing when it comes to AI as a market.
00:05:39.759 --> 00:05:42.639
And lots of this will be quite um covert.
00:05:42.800 --> 00:06:08.160
You know, I think that whilst AI is going to be a big transformational shift and is a big transformational shift, the way that we feel the impact of that in terms of the risk that businesses face and the way the industry um responds could be a slower um sort of rollout because AI and the technology is changing quickly, but the rate at which businesses utilize it and adopt it is changing at different paces.
00:06:08.480 --> 00:06:15.040
So we just need to continue to make sure that we're there for our policyholders, we're there for our customers.
00:06:15.279 --> 00:06:27.519
And in my mind, the role of the insurance market should be to really lean into these challenges, to provide certainty to our customers that we we can cover them for these new types of risks as and when they emerge.
00:06:28.000 --> 00:06:29.600
I mean, I suppose that's the thing, isn't it?
00:06:29.759 --> 00:06:42.079
And you know, if you look at it, um there are some that say sort of market conditions and obviously the recent very high profile attacks, not only in the UK, we had Jaguar Landrover, Mark Suspencer's, but across the world.
00:06:42.160 --> 00:06:53.519
I mean, we've seen, you know, we saw Asahi in um in Japan, where obviously they were they were days away from running out of their favourite beer, which was which obviously the Japanese were not exactly happy about.
00:06:53.680 --> 00:07:02.639
But um, I mean, on a smaller scale, I mean, do we think these attacks now have sort of almost created a tipping point for uh for SMEs?
00:07:03.600 --> 00:07:06.240
Yeah, yes, I I do.
00:07:06.319 --> 00:07:18.959
So, and I think it's interesting that that you mentioned the Asahi uh sort of beer example, slightly tongue-in-cheek, but it it does also bring the reality home of what what what these cyber attacks mean.
00:07:19.120 --> 00:07:29.360
So we've seen a significant increase in demand for cyber insurance um among SMEs in particular over the course of the past 12 months.
00:07:29.519 --> 00:07:35.279
And um that is in in in no small part being driven by high high-profile attacks.
00:07:35.519 --> 00:07:43.519
So um last year in the UK, just over 12 months ago, we saw um MS, a number of other other big high street brands get hit.
00:07:43.600 --> 00:07:52.639
Towards the end of the year in the UK, we saw JLR, the Sahi um event, which got sort of global um coverage, as you mentioned.
00:07:52.800 --> 00:07:57.040
And these attacks all brought cyber home as a real operational threat.
00:07:57.120 --> 00:08:10.800
And I think they they were different from the types of high-profile attack we saw in the past, in that a lot of the historic high-profile attacks we saw were more data breaches.
00:08:11.199 --> 00:08:24.879
And I think SMEs and I think SMEs in particular always struggled to resonate with big data breach-only events because you know SMEs don't tend to hold lots and lots of data.
00:08:25.040 --> 00:08:36.159
But it was different about the likes of um JLR, MNS, even the Sahase you mentioned, is that these had real operational impacts that customers of these organizations felt and could see.
00:08:36.639 --> 00:08:42.480
And that made the exposure hit home harder for um everyday businesses.
00:08:42.559 --> 00:08:49.600
Um, but it also made you know lots of brokers who perhaps weren't necessarily engaging their clients on cyber risk.
00:08:49.919 --> 00:08:56.159
Um, it gave them a big incentive to start talking about this because suddenly cyber was becoming real.
00:08:56.480 --> 00:09:01.200
Um, so absolutely, those high-profile attacks um helped a lot.
00:09:01.279 --> 00:09:05.120
And that tipping point has come also in part, I think, due to market conditions.
00:09:05.279 --> 00:09:15.519
So um we've seen pricing soften both in the cyber market and the broader insurance market, and that's meant that products, cyber products have become more accessible.
00:09:15.600 --> 00:09:23.679
Um, as I mentioned, both for new buyers who who perhaps weren't able to consider it before, but also for new brokers who weren't previously pushing it.
00:09:23.759 --> 00:09:31.279
Um, the market conditions combined with that the high profile nature of some of these events is has really increased that demand.
00:09:31.919 --> 00:09:47.279
Because it actually, to be quite honest, I suppose in Hawaii leads very nicely onto what you know the role that insurance um is and could play as as you know the awareness rises.
00:09:47.440 --> 00:09:58.879
But I suppose in Hawaii, um you know um it's one of these things I suppose we we still have that, you know, we still have that protection gap in some areas of of the market.
00:09:59.279 --> 00:10:03.840
But I think you know, I think we all agree that the brokers are going to be quite key.
00:10:04.000 --> 00:10:11.600
I think the brokers will be quite key on how how how we can how we can sort of address that protection gap.
00:10:12.480 --> 00:10:19.519
Yeah, I mean brokers aren't just key, they're they're fundamental, I think, to to the um to the success of this this product.
00:10:19.679 --> 00:10:28.320
So I think I think the valuation, sorry, I think the value proposition of cyber, you know, as a as a product, is it a valuable insurance product?
00:10:28.480 --> 00:10:30.480
I think that's been that's been proven out.
00:10:30.559 --> 00:10:36.399
I think you know, hundreds of thousands, if not more, businesses buy this product every year, and it works.
00:10:36.639 --> 00:10:43.919
So cyber insurance responds to tens of thousands of incidents and pays billions in claims every year now.
00:10:44.080 --> 00:10:50.559
So we do have a product that we know works for the customers and it's providing value for the customers that buy it.
00:10:50.720 --> 00:10:59.279
So the product works and businesses need it, and the conditions needed for increasing adoption in terms of sort of the pricing cycle, I think, are improving.
00:10:59.679 --> 00:11:07.519
Um what we now need to do is is up the ante and really sort of increase our focus on that education piece.
00:11:07.840 --> 00:11:14.639
Businesses know that cyber risk is a top threat, that awareness has developed quite a lot in recent times.
00:11:14.879 --> 00:11:19.200
I I think what they what they don't all know is that insurance can help.
00:11:19.440 --> 00:11:29.440
So most businesses assume a cyber risk requires a security solution, and of course it does in part, but more fundamentally it is a business risk.
00:11:29.600 --> 00:11:37.360
The risk is operational, it's reputational, it's financial, and those are risks that insurance is there to protect against.
00:11:37.519 --> 00:11:50.000
Now, a good cyber insurance product will provide security services as part of that proposition, but cyber insurance is about protecting the business as a whole, not just the security vulnerabilities that exist within it.
00:11:50.159 --> 00:11:55.039
So, as an industry, we need to get much better at articulating that.
00:11:55.279 --> 00:12:00.399
And brokers are fundamental to that cause because this is what brokers do.
00:12:00.559 --> 00:12:07.440
They talk to businesses about their risk and they provide them solutions that can help mitigate and transfer that risk.
00:12:07.519 --> 00:12:13.600
Um, and that's where, as an industry, we need to support brokers to start doing that even more effectively than they were before.
00:12:13.919 --> 00:12:33.679
I suppose, in a way, um, it really is a case of potentially, I suppose, brokers really need, you know, when they are, you know, really from their point of view now, it's a case of when we're sitting down with our clients and we're looking at their property risk, we're looking at their sort of you know, EL, you know, approvals liability risk.
00:12:33.840 --> 00:12:40.559
We should be to, you know, we should actually be in a situation where so you know the word cyber comes up in every conversation.
00:12:41.679 --> 00:12:42.639
Yeah, absolutely.
00:12:42.720 --> 00:12:57.519
And I think um where where we where the market has succeeded um is where I think we've seen particularly some of the larger global brokers, uh, maybe some of the larger national brokers, they've set up sort of specialist cyber divisions within their within their operations.
00:12:57.679 --> 00:13:05.600
So they've got that specialism in-house and they've been able to, you know, um stimulate growth that way and had a lot of success that way.
00:13:05.919 --> 00:13:18.240
What we need is we need to get to the point where every broker, because because cyber shouldn't be a specialist class of business, cyber should be as ubiquitously purchased as property insurance.
00:13:18.399 --> 00:13:24.320
It you know, it is it is the sort of property of the 21st century and the crime policy of the 21st century.
00:13:24.399 --> 00:13:29.360
The assets that we value today are intangible assets, they're software assets.
00:13:29.600 --> 00:13:38.159
So cyber should be being talked about by every broker to every client, not just by cyber specialists at the big brokers to the big clients.
00:13:38.480 --> 00:14:01.840
And um, you're absolutely right, from that perspective, we need to get brokers who um perhaps trade four or five different lines of cover and they're having renewal meetings with their clients to talk about property, um, to talk about you know public liability, to talk about other lines of coverage, feeling comfortable and confident that they can start talking to those clients about cyber risk.
00:14:02.000 --> 00:14:15.440
And I think we as cyber insurers, particularly, you know, specialist cyber insurers include ourselves in that, um, have real responsibility to get that education out to the brokers and support them in delivering that message and growing this market.
00:14:15.840 --> 00:14:17.519
I suppose that's one of the key issues, isn't it?
00:14:17.679 --> 00:14:25.360
I mean, there's a there is an education piece really, both for for the the brokers and also the client.
00:14:25.519 --> 00:14:34.080
Um, because things as you know as we've touched on earlier, I mean, you know, the the you know, cyber risks are rarely out of the headlines now.
00:14:34.240 --> 00:14:35.600
I mean, they they really aren't.
00:14:35.679 --> 00:14:50.960
I mean, and of course, there's a there's been a lot of work done by the UK government and obviously governments around the world to to highlight the fact that this is now you know a fundamental, it's actually a fundamental risk to you know, sort of GDP and and and in fact national security.
00:14:51.120 --> 00:15:13.360
Um so I suppose in a way it's it's it's what you know that education and I suppose access to access to the products will be one of the uh you know our two of the probably the the the big hurdles we now need to spend you know the the coming you know the coming months um looking to uh to overcome.
00:15:14.240 --> 00:15:15.840
Yeah, absolutely.
00:15:16.080 --> 00:15:23.679
And the um the sort of the high profile attacks are sort of one part of the the um the equation, you know.
00:15:23.759 --> 00:15:42.720
They they they sort of that they bring the awareness and they perhaps make the conversation easier to to raise for brokers and um for for you know they perhaps prime customers' clients to be more um uh receptive to those conversations.
00:15:42.879 --> 00:15:54.320
But then it's not always easy to to link a big high-profile event um that's happened to um the client that sat in front of you who might be a small business.
00:15:54.559 --> 00:16:06.639
It's not easy to link that event happening to why that client sat in front of you should buy a cyber insurance policy and what their specific needs and exposures are from a cyber perspective.
00:16:06.879 --> 00:16:09.600
So um, yeah, we're very conscious of that.
00:16:09.679 --> 00:16:17.679
We're conscious that brokers need tools to help make sure that they are equipped to have those conversations with their clients.
00:16:18.000 --> 00:16:43.200
We launched a um a series called um Masterclass um relatively recently, where brokers can upskill um their cyber knowledge and not just in relation to the technical side of what cyber is and how it works, but also the nature of conversations that might unravel with clients, sort of objections that they might face from small businesses who don't think cyber is relevant to them.
00:16:43.600 --> 00:16:57.440
Um, you know, these are the sorts of educational pieces that are really, really useful in giving the comfort and the confidence for brokers that haven't spoken about this class of business before to start raising it.
00:16:57.519 --> 00:17:12.000
Um, and then there are tools that we've got that can help brokers in terms of passing that information on to the client to let them see why they do need to take cyber exposure seriously and how cyber insurance can help in response to that.
00:17:12.240 --> 00:17:25.839
So, yeah, the awareness is one part, the education is another, making that education specific to the client that these brokers are speaking to, that's a really important part of the puzzle as well, because it needs to feel tailored, and that's how we know it has the biggest impact.
00:17:26.079 --> 00:17:27.680
I mean, that's the thing, James, isn't it?
00:17:27.839 --> 00:17:32.960
I mean, yeah, I think brokers are by their very nature entrepreneurial.
00:17:33.039 --> 00:17:43.440
They're you know, from their point of view, they're always, you know, their business is you know, their business is is is you know sort of looking at how they can drive both innovation and growth.
00:17:43.680 --> 00:17:52.559
Um, are you finding that, and again, as you say, you know, you're running the master classes, you've got a number of sort of educational issues out there open to brokers.
00:17:52.880 --> 00:17:56.720
Are you finding that increasing number of brokers now are actually coming to you?
00:17:56.799 --> 00:18:11.200
Because I suppose the big issue is the conversation has to be had where the brokers turn around and saying, Well, actually, James, hand on heart, I'm not too confident about, you know, I'm not too confident about discussing what you offer and where it fits with my clients.
00:18:11.440 --> 00:18:12.319
How can you help me?
00:18:12.400 --> 00:18:43.039
Are are you seeing more brokers now sort of being, you know, in a way being sort of honest and saying, look, we see the opportunity, but can you help us in and how we how we can sort of um you know sort of um express this to the client and and also um look at how they can, you know, look at how the client should you know or sort of express to the client their needs and how how the insurance market plays that part in in that sort of great greater cyber resilience.
00:18:44.079 --> 00:18:45.599
Yeah, no, absolutely have.
00:18:46.000 --> 00:18:52.640
We've seen that that hunger and that desire um to engage more with cyber and to learn more from brokers.
00:18:52.799 --> 00:18:57.759
Um I think we we launched our masterclass program um around the middle of last year.
00:18:58.000 --> 00:19:08.799
We've had well over 5,000 individual brokers um register and begin the masterclass training modules, which is you know fantastic.
00:19:08.880 --> 00:19:31.519
We we didn't foresee that level of engagement that quickly amongst our broker base, and I think that's a really strong signal that brokers are you know hungry for um content and education and material that can help making have this conversation more comfortable and help them be more confident in having the conversation.
00:19:31.680 --> 00:19:52.319
A big part of the focus with our content is in simplifying and demystifying this topic because I think what our industry has been quite guilty of in the past is um perhaps overintellectualizing um cyber as a topic in certain respects.
00:19:52.559 --> 00:19:57.359
Um, you know, it's a it's a technically it's a technical sounding risk.
00:19:57.519 --> 00:20:12.160
Um, the nature of cyber attacks and cyber threats, you know, that it's intangible by nature, it's not like property where you can sort of see, smell, feel, touch the exposure uh and the nature of what you're insuring.
00:20:12.240 --> 00:20:17.920
Uh, and I think that can make it seem a bit less accessible to lots of people.
00:20:18.240 --> 00:20:31.519
And, you know, in our in our minds, the way to overcome that is not to try and overcomplicate it, it's to try and simplify it because ultimately what we're still talking about is insurance.
00:20:31.680 --> 00:20:39.200
You're you know, customers have a set of assets which are valuable to them and they want to protect those assets.
00:20:39.359 --> 00:20:40.960
That's what this boils down to.
00:20:41.119 --> 00:20:46.079
It just happens that in the case of cyber, the the assets tend to be intangible.
00:20:46.160 --> 00:20:59.359
Um, the threat actors you tend to not be able to see, um, and there's often you know it might be quite difficult to understand exactly how these attacks occur, but fundamentally there's an asset that needs protecting.
00:20:59.440 --> 00:21:06.160
And when you start boiling it down to that, um, it suddenly all becomes much clearer, much easier to understand.
00:21:06.240 --> 00:21:21.119
And I think brokers appreciate you know, having content and um literature that that really tries to demystify and simplify as opposed to overcomplicate because this subject is too important to overcomplicate.
00:21:21.279 --> 00:21:25.759
We need we need cybers go mainstream, and we need brokers to help us do that.
00:21:26.079 --> 00:21:41.519
That comes to sort of the last question I was actually um as you were talking, was thinking about how how confident are you that the market is going to be able to, and you've put it very succinctly, move cyber insurance into the mainstream?
00:21:42.240 --> 00:21:43.599
I'm very confident.
00:21:43.759 --> 00:21:50.240
Um, you know, as I said before, I think the the value proposition of cyber has been proven out.
00:21:50.400 --> 00:22:01.359
Um, there are hundreds of thousands of organizations of all sizes in all industry verticals already purchasing and getting use out of this product.
00:22:01.599 --> 00:22:14.000
Um, you know, we see the um the good that cyber insurance does when um an insured is having their worst potential day possible.
00:22:14.160 --> 00:22:27.200
You know, their systems are hosed, they can't service their customers, they're staring down the barrel of serious financial um jeopardy, a cyber insurance policy is an absolute lifeline.
00:22:27.359 --> 00:22:36.880
And the fact that we see that happen tens of thousands of times on an annual basis now means that there is immense value in cyber insurance.
00:22:37.039 --> 00:22:57.119
And like I said, if um over the next, you know, I think what the last 12 months in particular and what we'll see over the course of the next few years is that if we can make access to that product easier for uh brokers and customers, um then I've no doubt that we'll see penetration of this product continue to continue to surge.
00:22:58.319 --> 00:23:02.799
James, that's that's super and um I've thoroughly enjoyed our conversation.
00:23:02.880 --> 00:23:05.119
Um it's been more than informative.
00:23:05.279 --> 00:23:32.720
I mean, and and and it's as you say, it's quite nice to actually get beneath the headlines because as I said, a lot of the time, a lot of the time what you tend to see is is the you know, it's when things go wrong, and it's actually it's a it's you know, I think that the the message I think the market really needs to go at is actually we're here to you know we're here it's more around resilience as well as it is disaster recovery, shall we say.
00:23:32.880 --> 00:23:39.359
You know, if we can it's far better to to prevent than than you know reparate, really.
00:23:39.519 --> 00:23:53.359
Um and it's uh as I said it's fascinating, I'm sure with the greatest respect, and I hope you'll you'll agree this is uh I'm sure we'll talk again because I'm you know this is this is a you know this is a topic that um that is gonna run and run.
00:23:53.440 --> 00:24:12.000
And I I think uh you know, with as we were saying, you know, with the implementation of more technology in the workplace and and in the home, um, you know, uh I think we are gonna be in a situation where the the cyber market is is is set to be mainstream and some, I think, in the in the in the years to come.
00:24:12.240 --> 00:24:24.160
Yeah, I I couldn't agree more and um yeah, we're we're we're very excited about where this market's going and working with our broker partners to to make sure their clients are getting the protection they need.
00:24:24.240 --> 00:24:28.240
And yeah, I'd be more than happy to come back and talk more on this topic, John.
00:24:28.559 --> 00:24:28.960
Brilliant.
00:24:29.039 --> 00:24:29.680
Thank you, Jones.
00:24:29.759 --> 00:24:30.640
I really appreciate it.
00:24:30.799 --> 00:24:31.599
Thank you.
00:24:33.200 --> 00:24:41.920
Thank you for listening to Maximum Exposure, Talking Emerging Risks, a new series of podcasts brought to you by emergingrisks.co.uk.
00:24:42.799 --> 00:24:53.599
We are a dedicated publication looking at the future of risk, delivering insightful news and cogent analysis on the key emerging topics facing the market in these turbulent times.
00:24:53.920 --> 00:25:08.480
With over 150,000 impressions every month, Emerging Risks has now established itself as the go to read for all those concerned with the latest analysis and trends in a dynamic and fast moving risk environment.
