Changes in policy terms and conditions

There is now increased appetite from both insurers and clients to evaluate property damage emanating from a cyber event (CZ) coverage. We are working with insurers to develop a proprietary wording to be able to offer this in addition to the existing standalone cyber coverage. Following the recent CrowdStrike outage, it is important for clients to ensure that they have full limits for contingent system failure for IT providers, although there are several insurers that do not currently offer this as standard.

Underwriting changes

Within the last 6 months the only notable new entrant into the market is Aegis, following the hire of Dan Johnson, previously at AIG. They are currently considering excess business but on a global basis. We have seen significant shifts in approach and appetite since the start of the year, particularly from Canopius. Most insurers are looking to grow their respective teams rather than reduce. We recently learned that Marcus Breese, the head of Arch Cyber, has resigned. At this stage, we are unaware of his next move and how Arch plan to replace him.

Notable claims

Ransomware claims continue to be prevalent within the market with new notifications hitting globally almost daily. A number of privacy litigation matters are now moving towards closing with some fairly significant settlements seen in the last few months above USD 20m. The CrowdStrike outage that affected thousands of organisations globally last month is likely to result in several claims hitting the insurers in London and around the world. However, at this stage it is too early to gauge just how much of an impact this will have. Insurers don’t seem to be too concerned as the outage was fixed in a relatively short timeframe, which is likely to be below the Waiting period for a large portion of insureds.