Cybersecurity Toolkit | American Academy of Actuaries

The American Academy of Actuaries’ Cyber Risk Toolkit, developed by the Academy’s Committee on Cyber Risk, is a series of papers addressing issues pertinent to cyber risk insurance and cyber exposure. This toolkit is intended to be a resource for interested readers of the general public, public policymakers, the actuarial profession, the insurance sector, and other stakeholders.

While the papers that follow stand alone, the complete toolkit offers a cohesive overview of the challenges posed in the cyber insurance market. The toolkit will be updated periodically to reflect new and emerging work from the committee.

An Introduction to Cyber

This introductory paper addresses some of the key aspects of cyber risk and insurance, such as general product market, and insurance coverages and features. It also discusses some of the more well-known cyber-attacks.

Cyber Threat Landscape

The cyber threat landscape is continually changing and evolving as attackers develop new tools and discover new attack vectors and defenders find new techniques to counter these attacks. Machine learning and artificial intelligence are being increasingly used by both attackers and defenders, and the importance of these tools is likely to increase in the future.

Silent Cyber

As cyber risks continue to emerge, insurers are facing losses from unintended coverages, despite explicit coverage of cyber perils in their underlying written policies. With each day, the world faces emerging cyber threats, including infrastructure attacks, identity theft, data breaches, hackers, and malware. This unintentional, non-affirmative coverage—or “silent cyber” risk—can be devastating to insurance and reinsurance companies.

Cyber Data

Unlike most other property/casualty insurance lines of business where insurers typically have relied on vast amounts of premium, exposure, and claims data collected over many years to develop tools based on statistically significant results, cyber insurers have historically had a lack of in-house data for evaluating cyber risk. While the amount of data available to cyber insurers is growing, standard actuarial pricing models used for other property/casualty lines of business do not work as well with cyber because insurers have either just entered the market and therefore have limited data, or they have been writing cyber for years but the exposure continues to evolve. This same limitation applies to reserving for cyber as well.

Cyber Risk Accumulation

Accumulation risk in insurance, also known as aggregation risk, refers to the likelihood of a greater-than-anticipated accumulation of claim costs due to multiple exposures being tied to the same event or a related event. Our growing digital connectivity and interdependence mean that a single cyber event has the potential to simultaneously impact a significantly large number of businesses around the world.

Cyber Risk Reinsurance Issues

Like the primary cyber insurance market, reinsurers are approaching cyber insurance with caution, and many are investing heavily in cyber underwriting capabilities. Nevertheless, confidence in understanding the risk has increased, which has led to an active appetite and expansion of reinsurance capacity in recent years.

Ransomware

Cybercrime is expected to keep growing as businesses increasingly rely on remote workers and the internet of things (IOT) continues to expand. One type of cybercrime that is rapidly increasing is ransomware attacks. Ransomware has many consequential effects, from temporary or permanent loss of data and complete shutdown of operations, to rendering hardware inoperable.

War, Cyberterrorism, and Cyber Insurance

As cyber insurance coverage continues to evolve and grow in application, an increasing concern among policyholders is whether policies will cover them when cyber incidents impacting them are tied to cyber and technology disruptions stemming from attacks that may be supported by nation-states. In particular, malicious actors might be tied to a given political or ideological affiliation and are sometimes—either directly or indirectly—associated with nation-states and state-backed military units.

Autonomous Vehicles and Cyber Risk

The line between cyber and auto insurance is blurring as sophisticated and often internet-connected autonomous vehicles (AV) become more prevalent. This section discusses the growth of AVs, their benefits, and their cyber risks, in addition to legislation and current regulations overseeing cyber insurance.

Digital Assets and Their Current Roles Within Cybercrime

Digital assets and their roles in cybercrime continue to increase. This paper seeks to provide a baseline understanding of digital assets for insurance industry practitioners whose lines of business may interact with digital assets and highlight recent trends surrounding their use within cybercrime.

Cyber Risk Resource Guide

This guide was developed to provide a set of resources, selected from those with an actuarial perspective, that can move the user one step closer to understanding the risks and issues around cyber. Because the public domain is filled with various publications and literature on the topic, this resource guide is intended to make it less daunting to identify the most effective resources to educate oneself on the relevant issues.

"Personal Cyber" Chapter for Cyber Risk Toolkit Released

The Committee on Cyber Risk released a new chapter in the Cyber Risk Toolkit, "Personal Cyber: An Intro to Risk Reduction and Mitigation Strategies." The chapter identifies some of the penetration points of cyberattacks from an individual’s perspective and examines how an individual can work to minimize their risk of being hacked.

SEC Cybersecurity Disclosure Requirements and Related Directors & Officers Liability Risks

The latest release in the Cyber Risk Toolkit, “SEC Cybersecurity Disclosure Requirements and Related Directors & Officers Liability Risks,” details how the United States Securities and Exchange Commission is regulating cybersecurity and the reporting of cybersecurity incidents by publicly traded corporations to investors, as well as the implications of these regulations.