Addressing Cyber Risk

May 11, 2017
MARSH 1

“Take-up rate” refers to the overall percentage of clients that purchased standalone cyber insurance coverage. 

US Cyber Insurance Take-Up Rates
MARSH

US Cyber Insurance Growth Rates

2

“Growth rate” refers to the percentage increase from 2015 to 2016 in the number of clients purchasing standalone cyber 

insurance coverage.
MARSH 3

Marsh’s recent survey of capacity for large purchasers indicates cyber capacity — stated but not necessarily deployed — is 

approximately $1 billion. Through the first quarter of 2017, many large towers placed of between $200 million and $500 million in 

limits have been placed. Insurers are increasingly willing to deploy large lines either in single layers or with ventilation. 

US

59%

Bermuda 

20%

London

20%

Reinsurance 

1%

+$890 

million

Total Cyber Capacity

US

63%

Bermuda 

15%

London

21%

Reinsurance 

1%

+$1.4 

billion

Total Cyber Capacity

2014 2017

Cyber Insurance Market Capacity
MARSH

Privacy Liability

Data Asset 

Restoration

Network 

Business 

Interruption

Cyber Extortion

4

Basic Cyber Coverage Expanded 

Cyber Coverage Extension of 

Cyber Coverage

Broader terms of 

coverage for 

economic impact due 

to network outages.

Network 

Security 

Liability

Provides coverage for 

physical outcomes 

from network security 

incidents. 

Evolving Cyber Coverage
MARSH

• Heartbleed is a configuration 

vulnerability

• Heartbleed affected approximately 

500,000 websites 

• Prominent websites, online banking, 

VPN, phones, routers, medical 

devices, TVs, embedded IoT and 

millions of other devices

Systemic Cyber Risk 

Widespread Vulnerability
MARSH

• DYN is a major DNS 

Service provider. 

• October 2016 - Mirai 

Botnet Attack launches 

massive Distributed 

Denial of Services 

Attacks 

• Affected approximately 

145,000 domains (Twitter, 

Reddit, CNN, PayPal)

Systemic Cyber Risk 

Single Points of Failure

Source, Level3
MARSH

• Lloyd’s Emerging Risk Report – 2015

• Imagines a ”sensational” cyber attack that 

triggers a widespread blackout 

• Outage reaches 15 states and Washington 

DC (93 million people without power)

• Shuts commercial activity responsible for 

32% of the US economic production.

Key Findings

• Cyber attack is a peril that could trigger 

losses across multiple sectors of the 

economy.

• The insurance industry should enhance 

the quality of data available and to 

continue the development of probabilistic 

modelling.

Systemic Cyber Risk 

Cascading Consequences

Source, Lloyd’s 2015
MARSH

Protecting Against Cyber Risk Aggregation

Source, AIR Worldwide

Tools to prevent cyber 

risk aggregation include

• Policy Language

• Underwriter 

Submissions

• External 

Assessments

Tracking “Silent Cyber” 
MARSH

Improving Cyber Resilience through Behavioral Change

Cyber insurance can create important incentives that 

drive behavioral change

• Causes third-party assessments of cyber practices

• Ties insurers to insureds through financial incentive

• Aligns mitigation, response and recovery tools

• Partnership between industry and government is 

essential for building cyber resilience

Pursuant to Executive Order 13636, 

the Departments of Treasury, 

Homeland Security and Commerce 

produced separate reports on cyber 

incentives. Each identified cyber 

insurance as a potential incentive for 

adoption of better practices.
This document and any recommendations, analysis, or advice provided by Marsh (collectively, the “Marsh Analysis”) are intended solely for the entity identified as the 

recipient herein (“you”). This document contains proprietary, confidential information of Marsh and may not be shared with any third party, including other insurance 

producers, without Marsh’s prior written consent. Any statements concerning actuarial, tax, accounting, or legal matters are based solely on our experience as insurance 

brokers and risk consultants and are not to be relied upon as actuarial, accounting, tax, or legal advice, for which you should consult your own professional advisors. 

Any modeling, analytics, or projections are subject to inherent uncertainty, and the Marsh Analysis could be materially affected if any underlying assumptions, 

conditions, information, or factors are inaccurate or incomplete or should change. The information contained herein is based on sources we believe reliable, but we 

make no representation or warranty as to its accuracy. Marsh shall have no obligation to update the Marsh Analysis and shall have no liability to you or any other party 

with regard to the Marsh Analysis or to any services provided by a third party to you or Marsh. Marsh makes no representation or warranty concerning the application of 

policy wordings or the financial condition or solvency of insurers or reinsurers. Marsh makes no assurances regarding the availability, cost, or terms of insurance 

coverage. All decisions regarding the amount, type or terms of coverage shall be your ultimate responsibility. While Marsh may provide advice and recommendations, 

you must decide on the specific coverage that is appropriate for your particular circumstances and financial position. By accepting this report, you acknowledge and 

agree to the terms, conditions, and disclaimers set forth above.

Marsh is one of the Marsh & McLennan Companies, together with Guy Carpenter, Mercer, and Oliver Wyman.

Copyright © 2017 Marsh LLC.

All rights reserved.