Cyber Insurance: Regulatory Expectations and Underwriting Challenges in Asia Pacific

A Line That Has Grown Faster Than the Frameworks

Cyber insurance has moved from a niche product purchased by large technology companies to a mainstream coverage line sought by businesses across virtually every sector. The growth has been driven by the visible cost of cyber incidents -- ransomware attacks, data breaches, business interruption from system failures -- and by the requirements of regulators, customers and insurers in other lines who make cyber coverage a condition of doing business.

In Asia Pacific, the cyber insurance market has developed rapidly but unevenly. Singapore and Australia have established markets with a relatively wide range of insurers offering cyber products. Other markets in the region are at earlier stages, with lower penetration and less consistent product standards. Across all markets, the regulatory frameworks governing cyber insurance as a product and cyber risk management as a supervisory expectation are developing alongside the insurance market.

For insurers writing cyber risk in the region, and for businesses purchasing it, understanding both the current state of the product and the regulatory environment around it is increasingly important.

What Cyber Insurance Covers (and What It Does Not)

One of the persistent challenges with cyber insurance is that the scope of coverage varies significantly between policies and is not always well understood by buyers or, in some cases, by the intermediaries who sell it.

First-party cyber coverage typically includes:

• Business interruption losses arising from a cyber incident, including the cost of system restoration
• Data recovery and reconstruction costs
• Ransomware payments and crisis management expenses
• Notification costs and credit monitoring for affected individuals following a data breach
• Reputational harm response costs

Third-party cyber liability coverage typically includes:

• Legal defence costs and damages arising from claims by affected third parties following a data breach
• Regulatory investigation costs and fines where insurable under applicable law
• Network security liability for damage caused to third parties by the insured's systems

What standard policies typically exclude or limit:

Physical damage arising from a cyber event is commonly excluded or subject to sub-limits. The interaction between cyber policies and property policies for losses that have both a cyber origin and a physical consequence -- a fire caused by malware manipulating industrial controls, for example -- is an area of ongoing dispute and product development.

War and terrorism exclusions have been applied to cyber policies with varying degrees of precision. The attribution of state-sponsored cyber attacks to specific nation-states is often uncertain, and the scope of war exclusions in cyber policies has been the subject of significant litigation. The Lloyd's market has moved to require clearer exclusions for losses arising from state-sponsored attacks, and this position is influencing market practice in Asia Pacific.

Systemic or widespread cyber events -- where a single vulnerability or attack affects a large number of insureds simultaneously -- create accumulation risk for insurers that is not well managed by traditional reinsurance structures designed for geographically distributed natural perils.

Regulatory Expectations on Cyber Risk Management

Across Asia Pacific, regulators are raising expectations on how financial institutions manage cyber risk. For insurers, this has two dimensions: managing their own cyber risk as a regulated entity, and assessing the cyber risk they take on as underwriters.

MAS Technology Risk Management Guidelines set out expectations for how financial institutions including insurers manage technology and cyber risk. The guidelines address governance, risk management processes, access controls, incident detection and response, and third-party risk management. MAS has been conducting supervisory reviews of technology risk management across the financial sector and expects continuous improvement in the maturity of cyber risk governance.

Cyber risk within the ORSA is increasingly an area where MAS expects substantive assessment. For insurers, this means considering not just their own operational cyber risk but the potential accumulation of cyber losses in the insurance portfolio under stress scenarios. The correlation of cyber losses across policies -- particularly for widespread events affecting cloud infrastructure or widely deployed software -- needs to be modelled and the capital implications assessed.

Product governance for cyber insurance is an emerging area of regulatory focus. Regulators in Singapore and across the region have been paying attention to whether cyber insurance products deliver the coverage customers expect, whether the exclusions are adequately disclosed, and whether claims are handled fairly when significant cyber events occur.

The Underwriting Challenge

Underwriting cyber risk is genuinely difficult in ways that distinguish it from most other insurance lines. The risk is constantly evolving as threat actors develop new techniques, as the technology landscape changes, and as the regulatory environment for data protection and breach notification develops. The historical loss data that underpins most actuarial pricing models is limited and may not predict future losses well.

Key underwriting challenges:

Accumulation and correlation: A major cyber event can affect thousands of insureds simultaneously. The NotPetya malware event, a ransomware attack on a cloud provider, or a critical vulnerability in widely deployed enterprise software can create correlated losses across an insurer's entire cyber book. Accumulation modelling for cyber is less mature than for natural catastrophe perils, and the industry is still developing the tools to manage this exposure.

Moral hazard: The existence of cyber insurance can affect the security investment decisions of insureds. The underwriting process -- requiring completion of detailed questionnaires about security controls, patch management, access control and backup practices -- is partly a tool for pricing and partly a mechanism to ensure that insureds maintain a defensible security posture. The quality of underwriting interrogation varies significantly across the market.

Adverse selection: Organisations that know they have poor cyber hygiene are more likely to seek comprehensive cyber coverage. Distinguishing the risk quality of applicants with similar disclosed controls requires actuarial and technical expertise that is still developing.

Silent cyber: Cyber losses arising under policies that were not designed as cyber products -- property, general liability, directors and officers -- create exposure for insurers that have not explicitly excluded or priced for cyber risk. Managing silent cyber requires a systematic review of the non-cyber book for unintended cyber exposure.

Pricing in a Developing Market

Cyber insurance pricing has been volatile. After years of soft pricing during which losses were modest relative to premium, a period of significant loss activity -- driven primarily by ransomware -- led to substantial rate increases in 2020 to 2023 in most markets. The market has since stabilised in many geographies, but the pricing environment continues to vary by risk quality, sector and coverage structure.

For Asian markets, the pricing dynamics have differed from the London and US markets that drive global cyber pricing trends. Penetration rates are lower, historical loss experience is less developed, and the insurer appetite in some segments has been limited. For buyers in the region, this creates a less competitive market in some segments than buyers in more developed cyber markets experience.

Key pricing variables in the current market include:

The revenue and data footprint of the insured, which proxies for the potential severity of a breach. An insurer underwriting a large financial institution holding sensitive personal data of millions of customers is writing very different risk from a small professional services firm.

The security controls in place, particularly around multi-factor authentication, endpoint detection and response, backup and recovery capability, and patch management. These controls are the primary modifiable risk factors that underwriters use to differentiate price.

The sector of operation, reflecting different threat actor targeting and regulatory environments. Financial services, healthcare, critical infrastructure and government contractors face more sophisticated and persistent threat actors than most other sectors.

We work with insurers across Asia Pacific on insurtech and digital insurance strategy including cyber insurance product development and regulatory navigation, and on enterprise risk management frameworks that incorporate cyber risk as an explicit risk category with appropriate governance, monitoring and capital assessment. If your organisation is developing or reviewing its approach to cyber insurance as an underwriter or as a buyer, our team is available to discuss your specific position.