More Data, More Digitalization Creates More Cyber Risks

More Data, More Digitalization Creates More Cyber Risks

Corvus Insurance Holdings offers cyber risk insurance that relies on advanced technology to underwrite coverage for companies with up to $2 billion in annual revenues.

Phil Edmundson said he founded the company to use IoT, AI, big data and social media to improve underwriting, and provide data analytics and business intelligence to its brokers and policyholders.

Insurance, which has been the technology laggard in financial services, is struggling to modernize. In the past, said Edmundson, a broker would ask his or her client to fill out a long paper application with questions about the company’s existing cyber security. In most cases the person tasked with buying insurance for the firm didn’t have answers about existing IT security, the responses were done poorly and then the insurance companies took months to respond.

“The process had a lot of friction,” he said. “We are trying to solve for that by giving the broker and the policy holder an experience where they give us a small amount of information — the industry, the company’s annual revenue and their main web address.”

Corvus then uses its proprietary software to run a scan on all the company’s related URLs.

“Large organizations may have hundreds of domain names that they have reserved, and our software takes about 10 seconds to use a bunch of tests and processes to be 99% sure we find those sites, and we test the web sites and associated email servers, since they are the place of vulnerability for most cyber attacks.”

The scan is free and shows a company any vulnerabilities. Corvus will price a policy based on the level of risk and provide a company with a list of actionable items to fix security problems. It won’t underwrite insurance for companies that are high risk, although they can apply for a scan after taking steps to fix the gaps in their security.

“Corvus is trying to build technology that is beneficial to the underwriter,” said Edmundson, “identifying those bad risks that are not so obvious to everyone else.”

The scan also produces data analytics, reports and recommendations that allow brokers to give better advice to their customers —it helps everyone in the process.

“Results of the scan vary immensely. Very small organizations with less than $5 million often don’t have anyone in charge of IT, let alone cyber security. The largest — we quote up to $2 billion in revenue — organizations almost always have mature and robust cyber secure team members. But even they can slip up and forget about something, like a server in a closet in Arizona they picked up when they made an acquisition two years ago. In the $5 million to $500 million we end up with some fantastic conversations and often become part of their IT team.”

The risks are changing all the time in this very dynamic space, he added. Although cyber insurance has only been around for 15 years or so, the National Association of Insurance Commissioners says it has become a $3.1 billion business in the United States. That’s because so much of business is now digital, and subject to cyber attacks which the NAIC said can lead to identity theft, business interruption, reputational damage, data repaid costs, theft of customer information, credit monitoring for affected customers, litigation and outright ransom demands.

Edmundson sees an increase in attacks on health care organizations. Admitting it is just speculation, he said that health care organizations may be seen as vulnerable because they are very stressed, and that includes their IT staff. Attacks may use clickbait such as good or bad news about the Corona Virus. Criminals are looking for credit card or patient information, which can be sold on the dark web.

Although Corvus scans are generally available only through brokers, because of the COVID-19 crisis Corus is offering the scans free of charge to any health care organization, Edmundson said.

The Corvus scans looking for a company’s URLs are a better, and certainly faster, that having an underwriter read through a 75-item question insurance application.

“The approach we use is to get a more effective understanding of the risk and reduces the most expensive aspect, human underwriting, by 80 percent.”

It also means underwriters are spared the tasks for scrolling through pages of information an scoring responses.

“We get better answers and get them quickly and easily, then an electronic file lands on an underwriter’s desk with a few remaining areas of concern or ambiguity that are left to her final judgment. It’s a much improved workflow. Our underwriters come from the largest insurance companies; they like to work at Corvus because they don’t have to do the least interesting part — sorting through these applications and scoring.

Corvus is a managing general underwriter.

“We do the underwriting, because the technology is proprietary so we keep it in-house but we do not take the risk. — it is passed on to the Hudson Insurance Group

Cyber insurance provides an opening wedge into the Corvus group’s growing array of insurance offerings, Edmundson said.

We are already beyond just cyber with cargo insurance, professional liability insurance and we will launch a series of products for financial institution — all of the products leverage additional data sets we can use to automate the process and gain more insight.”

Corvus is cyber first, he added, but that provides access to a broad range of companies because almost all business have some cyber risk and that is expanding as companies pursue greater digitalization to improve operations.

“We see a lot of areas where processes are being simplified, where old methods of long applications are being questioned and replaced with better, more accurate data sets that can be connected through an API and provide a digital experience to a broker or policy holder that feels more like going to to Amazon’s web site rather than applying for insurance.”

COVID-19 is accelerating the move toward more digital because insurance companies and customers want to reduce or avoid in-person meetings for applications and claims adjustments. Companies are settling claims using smartphone photos of damage to a house or auto and signing up clients for life insurance online — like Ladder and Ethos. Companies using technology to offer remote applications and claims processing have an advantage when nobody wants an adjuster or insurance sales person coming to their home, he added.