According to the report’s analysis, nearly 50 companies disclosed they would be unlikely to acquire cyber insurance on acceptable terms. Two companies stated they did not carry cyber insurance at all, with one of them acknowledging the costs and restricted coverage as causes for not carrying cyber insurance.
“The combination of a rapidly morphing cybersecurity risk and limited historical and standardized data has presented challenges to insurers’ models to price cybersecurity insurance accurately,” Jaconi explained. “The past few years, insurers have disclosed significant losses on cyber. Because of these losses and the uncertainty surrounding cybersecurity risk, insurers are being more selective on coverage.”
The Deloitte-Arkley report found that over 40% of companies disclosed explicitly that they had not experienced a material cybersecurity incident. “Material” is the key word.
The SEC has required disclosure of material cybersecurity incidents — actually anything material to a reasonable investor — before the final rule; however now, the enhanced guidance explicitly requires the disclosure of material cybersecurity incidents.
The report further notes that certain sectors were more likely to report that they had not experienced a material cybersecurity incident, with half or nearly half of the companies in the Utilities, Materials, Industrials, Financials, Energy, and Consumer Staples sectors so stating.
About 10% of companies discussed they experienced specific cybersecurity incidents, all identifying the date of either the incident, the discovery of the incident, or the announcement of the incident.
Deloitte and the Arkley Institute have worked closely together over the last three years for the deep dive series. Each organization brings valuable, yet different perspectives, including those from student researchers.
Owen Ticer ’24 is one of those students who validated the data required to report the results of the study. And it’s not his first time. Ticer relished the added responsibility for this report, now that his former student partners had graduated the previous spring.
“Most of the initial research had been done, but my role was to sift through all the data and verify the data. I managed a large spreadsheet to analyze all the findings,” Ticer shared.
Nothing in the final report was too shocking for the recent graduate who majored in Public Policy with a minor in Risk Management.
“It was really interesting to see how certain companies approach different strategies for cybersecurity risk and understanding the struggle to get insurance,” Ticer added.
Interning for AIG and working as a research assistant for the Arkley Institute have prepared Ticer for the future. The experiences have sparked his interest in a career as a cybersecurity insurance underwriter.
“Through these experiences, I have a deeper understanding of the potential threats to companies with cybersecurity risks, but it’s still only the surface.” Ticer said. “It’s not ‘if,’ but ‘when’ you’ll likely be hacked.”
The learning outcomes undoubtedly will help Ticer apply what he knows post-graduation at AIG. As cybersecurity risk continues to rise, it’s almost a given the insurance industry is going to need students like Ticer studying risk management to safeguard the future.
The examples highlighted above are just a few of the key findings. Read the FULL REPORT analyzing general risk factor disclosures as well as cybersecurity risk factor disclosures and recommendations.
