Reinsurance broker Lockton Re has warned critical infrastructure presents systemic exposures for the cyber market. Those exposures – spanning utilities, telecommunications and financial infrastructure – sit beyond the scope of the current market.

It published a report which found that critical infrastructure clauses in cyber insurance are inconsistent across the market. The report, When the Lights Go Out: Cyber’s Infrastructure Blind Spot, examines how those clauses have evolved, how they are applied, and how they are interpreted across the cyber insurance and reinsurance market.

A critical infrastructure clause defines which infrastructure sectors – such as utilities, telecommunications and financial infrastructure – fall outside, or are limited within, the scope of a cyber insurance or reinsurance policy. It is the wording that sets the boundary between the cyber risk the market is prepared to carry and the systemic exposure it is not. Definitions of critical infrastructure have been updated over time, often in response to specific cyber-attacks, but the language inevitably falls behind the technology it describes.

The broker modelled a range of scenarios to illustrate the potential impact of critical infrastructure clauses in cyber insurance. The modelling demonstrated a potential 20% relative decrease in industry loss ratios at the 1-in-50 (1:50) return period. It added the figure illustrates the range of outcomes that clause wording can produce; it is not a forecast of any single event.

Oliver Brew, head of cyber centre of excellence at Lockton Re and co-author of the report, said: “The clauses have been neglected in the wake of the industry discussion of cyber war clauses. Clarity of intent for critical infrastructure is key to understanding where the boundary lies of what is insurable. Our review of current critical infrastructure clauses identified significant inconsistencies and shortcomings across the market. The result is uncertainty for insurers, reinsurers, brokers and policyholders alike.”

Key findings in the report Included:

• Critical infrastructure clauses in cyber insurance are inconsistent across the market. Lockton Re’s review of current wordings identified significant inconsistencies and shortcomings.
• The ambiguity creates uncertainty for insurers, reinsurers, brokers and policyholders alike.
• Scenario modelling demonstrates a potential 20% relative decrease, or 15-point loss ratio reduction in industry loss ratios at the 1:50 return period.
• The clauses have been neglected in the wake of the industry discussion of cyber war clauses.
• Governments are increasingly treating data centres as critical infrastructure. That presents a new challenge for insurance products, which must be clear about the coverage they maintain as the definition widens.

Laura Betts, cyber account executive at Lockton International and co-author of the report, explained: “We engaged with participants across the market including insurers, reinsurers, brokers, and industry associations to provide insights. With the rapid advancement of new technology, insurance policy language has failed to keep up with the changes in the ways technology is used.”

Brew added: “There is an urgency to ensure that the intent of these clauses is aligned with the reality of how they can be interpreted. It is incumbent on the whole industry to improve the clarity of what is intended in order to enhance the industry’s reputation.”

Ed Le Flufy, global head of cyber at Lockton Re, concluded: “As new technologies proliferate and aggregation potential grows, the definition of what constitutes critical infrastructure and clarifying the coverage afforded by the market is essential to sustainable growth.”