Cybercrime occurs daily, fuelling demand for products such as cyber-insurance, and Asia is likely to witness strong growth in these crimes, the Monetary Authority of Singapore says.

Hackers’ attacks on banks and other firms mean there is growing need for insurance against cyber-attacks, with Asia likely to see a large upswing, Singapore’s central bank and regulator has said. The watchdog has also launched a programme to explore this form of insurance protection.

Cyber-attacks, and the continued lack of preparedness among many organisations, also create opportunities for those in the technology and security space, Bernard Wee, executive director, Monetary Authority of Singapore, said at a recent summit on such risks.

Asia, while still a rookie in terms of responding to the threat in some ways, has great potential to move forward, he said.

The cyber-security market in the Asia-Pacific region is projected to grow at more than 15 per cent per year until 2019. Munich Re expects Asian market volumes for cyber insurance covers to grow to as much as $1.5 billion in 2020. In Singapore, AIG estimates that cyber insurance penetration could rise from 9 per cent today to 40 per cent by 2020.

Wee said that despite growing risks, cyber-insurance adoption by small- and medium-sized enterprises remains at less than 10 per cent. Market penetration also varies by sector, with manufacturing companies showing a take-up of less than 5 per cent, compared to financial services, technology and telecommunications companies, which are at around 35-42 per cent.

When JP Morgan disclosed in October 2014 that 76 million clients’ accounts had been hit, it added to a litany of stories of such attacks that have pushed cyber-crime up the wealth management agenda. A 2015 survey by PricewaterhouseCoopers showed more than 100,000 cyber-attacks occurred every day in the world in 2013, a 66 per cent increase every year on average over the previous four years.

Attacks are encouraging more firms to adopt cyber-insurance. Gross written cyber-insurance premiums have grown by 38 per cent per year over the last five years, from $500 million in 2009 to $2.5 billion in 2014. The global cyber-insurance market is expected to reach $7.5 billion by 2020 (source: PwC). However, the picture varies sharply by region: the US is expected to account for 90 per cent of market share, followed by Europe ($150 million). Asia is expected to remain negligible, Wee said. 

One headache for firms is getting insured in the first place. “Cyber-insurance policies are not standardised, and the terms and exclusions can vary dramatically from one insurer to the next. For instance, some policies cover only first party losses (e.g. lost revenue and continuing operating expenses or cost of restoring or re-creating lost data), others cover only third party liabilities (e.g. claims brought against the insured by those whose private data have been breached), while others yet cover both. Then there are the usual issues of adverse selection, lack of historical data and the dynamic nature and randomness of cyber risks that impede the development of the market,” Wee said.

Project
Separately, the MAS announced the “Cyber Risk Management Project”, which it described as “unique”. The project engages potential buyers of cyber-risk insurance; a cyber risk assessment tool will also be developed to help buyers understand the extent and sources of their cyber-risk exposure. The project will aim to create reliable databases, methodologies, analytical tools and models underpinning confident underwriting, and develop new or adapt existing products more aligned to buyers’ needs. 

The project is led by Nanyang Technological University’s Insurance Risk and Finance Research Centre and supported by the insurance industry and the Cyber Security Agency. The project has also attracted academic figures from St John’s University in the US, the University of Waterloo in Canada, and the Geneva Association.