Moody’s Cyber Industry Steering Group: Fostering sustainable cyber growth

In September 2023, Moody’s announced the launch of its Moody’s RMS Cyber Industry Steering Group alongside founding members Axis Capital, Bitsight, Gallagher Re and Munich Re.

The group was created to help the industry better navigate the dynamic cyber risk landscape, manage cyber accumulations with increased confidence and deepen understanding of systemic risks and tail exposures.

It has already been initiating important research projects, developing improved cyber risk assessment tools and leading a series of market education initiatives. The group believes that by advancing the industry’s understanding and quantification of cyber risk, this will help to attract capacity and support the market’s sustainable growth, and group members have been explaining some of the issues the industry faces.

CrowdStrike raises questions

Material supply chain incidents including the CrowdStrike event have highlighted the complex challenges and importance of understanding risk aggregation and how the insurance market can best manage widespread events.

Group member Jürgen Reinhart, chief cyber underwriter at Munich Re, commented on the recent CrowdStrike event: “It once again focused public attention on the potential fallout from a widespread cyber event, reinforcing the importance of further strengthening market confidence in robust accumulation management. Accumulation risk may currently deter potential risk carriers from entering the lucrative cyber business, limiting the capacity to protect clients in their digital ventures.

“While challenging, understanding systemic cyber risks is crucial for the industry’s growth. Munich Re continues to invest in expertise and partnerships and is actively contributing to sustainable market expansion.”

More attention on cloud outages

The steering group is also exploring key research topics that could help to bring more confidence in understanding systemic risk. One topic under close examination is cloud outages – a key driver of tail risk and an area where market views are divergent. With increased dependence on cloud service providers for critical business services, understanding the infrastructure is increasingly important, including the risk and impact of any disruption. Having data-driven techniques to model cloud outages with a similar level of sophistication to Moody’s Network Intrusion Model will help bring increased confidence around the tail risk.

Importance of technographic data

As part of the ongoing effort to empower the market with foundational knowledge around cyber risk, the steering group aims to bridge the cyber data gap through in-depth explorations of the role of technographics, the value these insights can bring, and ultimately where and when technographic indicators can greatly boost cyber risk management and assessment workflows.

Group member Stephen Gibson, head of cyber exposure management at Axis Capital, explained why the use of technographic data for cyber is important: “A deeper understanding of the technographic landscape within a given portfolio can assist in more optimal risk selection, exposure management and event response. A broader, more consistent and standardised technographic perspective of market exposures can allow current and future carriers to manage their cyber appetites more efficiently and effectively, contributing to reduced market uncertainty.”

Group member Justyna Pikinska, head of cyber analytics at Gallagher Re, raises the risk of not having effective technographic data: “A lack of targeted use of technographic data in systemic risk modelling could place an artificial ceiling on our view of catastrophic cyber event accuracy (such as concentration risk by supplier in a specific industry). Limited or misplaced utilisation of this data could result in our view of tail risk being unable to reflect the nuances of individual portfolios (such as resiliency to the attack or recovery period afterwards), and risks stifling the successful growth of cyber as a class.

“Realising technographic data’s potential to provide greater accuracy in quantifying a cat footprint and losses will take a combination of carrier, reinsurer, modelling and data expertise over the long term. Gallagher Re are delighted to be part of this group which is perfectly placed to take the long view on technographic data and other areas required to cultivate a successful future for the cyber insurance market.”

Joe Melly is senior director of insurance strategy and innovation at Moody’s