Ransomware as a Service (RaaS)…

If nothing else, the recent enforced and extended shutdown of the mainline operations of Colonial Pipeline, a key East Coast US oil products pipeline, has highlighted, yet again, that cyber risk is a very real and growing threat, and can have significant direct and indirect impacts if an attack is carefully targeted.

The vulnerability of utilities and infrastructure to cyberattacks has been flagged as an issue for a long time; and was amply demonstrated by a now infamous attack on the Ukraine’s power grid during the winter of 2015, generally attributed to those acting in concert with or at the behest of the Russian government and/or security services. Reportedly, the US and the Russian governments have also deliberately penetrated each other’s electricity grids and installed what one might term “latent” capabilities. The cyberattack on US government departments and agencies in December 2020 (again allegedly involving Russian state-affiliated actors) simply reinforces that this is a continuing struggle- sometimes covert; sometimes, as with the Colonial Pipeline hack, very public

In the tech business realm, where subscription models and “X” as a Service are, quite rationally, all the rage, there is a continuous arms-race between the “black” and “white” hats- one which (re)insurers will be paying nervous attention to, not only in terms of protecting their own data-built and -dependent businesses, but more so in terms of the explicit or “silent” cyber exposures they may have within their policy portfolios. The increasing scale, sophistication and impact of more recent attacks should give pause to anyone who still thinks that the risks are predictable, and so manageable across a large, diversified portfolio. The reach of certain operating and software systems demonstrates that the classic “industry-” or geography-based approach to risk mitigation can prove seriously misguided.

Not only that, but there seems to be an ever-fatter left tail emerging in the risk profile for cyber covers, as hackers target ever larger enterprises, and have the potential to cause greater economic damage, or try to extract larger “ransoms”. As author Misha Glenny, quoting cybersecurity business Bitdefender, pointed out in a recent Financial Times article, registered (i.e., disclosed) ransomware attacks in 2020 were 485% higher than in 2019. Imagine if the rate or scale of “traditional” CAT events increased 5-fold: what would that do to your “standard” risk model? How does one price for a 5-fold increase in frequency within a single accident year, let alone magnitude?

And when “Dark Web” hackers actively advertise their services and aim to recruit “franchisees”, one knows that hacking-for-profit has moved from being a threat that lurked in the shadows, and rarely became public (if the victims were able to suppress disclosure), to a more “mainstream” activity, joining the catalogue of ways in which criminals can make money, or cause mayhem. Frankly, we would not be surprised if “recognized franchises” (think Mafia or Yakuza equivalent) start “offering protection” against being hacked or subject to ransom demands for those who pay a fee for that “service”. In fact, the approach probably already exists!

In this context, it now surely behooves those (re)insurers who write cyber covers (Awbury does not) to fundamentally re-think whether and how they can sufficiently segment their markets and covers to provide capacity and aggregations which they can control, at a price and specification that an Insured is willing to pay. Demand is surely rising (and the Colonial Pipeline hack is proof of the risks) and it will be interesting to see how capacity and pricing respond.

The Awbury Team

The Vision Thing…

Corporate websites are full of “vision” or “mission” statements. It is something that seems to be expected, and there is nothing wrong with an entity’s founders or Board creating such a statement- after all, it is useful to know why you are doing what you do, and give external parties some idea.

If one creates an entity which is intended to prosper and create value, you have to start with a basic premise as to why it should exist. This helps all those involved know the goal(s), and reduces the scope for misunderstanding and diffusion of purpose. If there is disagreement, the odds of that entity succeeding are greatly reduced.

Of course, having a vision and being “inspired” is all very well, but real value is only created through rigorous execution, which requires an effective mix of strategy and tactics. People will, and should, only subscribe to your vision if they have evidence of it operation and results.

Getting strategy right is often difficult, because one has to move from the theoretical (vision) to effective implementation. Perspiration follows inspiration, and execution is often far harder than anticipated, as the real world is not an ordered and static theoretical construct to which one can easily apply leverage, but a complex adaptive system which has the capability for inflicting endless disappointment and frustration. Plans are supposed to work; money and time are expended, but the outcome is uncertain- the ability to adapt is an essential skill.

So too is communication, whether of targets, timelines, or deliverables. While, as noted, these may need to be adapted, they must be clear. And, there is nothing wrong with them seeming unreasonable. Human beings respond better to stressors (as long as they understand their purpose) than one might suspect, and no organization with a sustainable business model and competitive edge was ever built by taking a leisurely approach! One just has to be able to separate the important from the trivial or redundant (another necessary skill), and be ruthless in prioritization.

It also helps to build a “library” of processes and templates that are able to be combined in ways that are effective, without those involved having constantly to “re-invent the wheel”, thus reducing cognitive load, and providing more time for creative thought and problem-solving (because there will be problems!)

Similarly, decision-making processes need to be fit-for-purpose and actually permit the making of decisions. It is remarkable how many supposedly sophisticated and well-resourced entities are very poor at doing this; which creates a repetitive failure of execution, and frictions which actively retard value creation.

And if you do not have the right mix of knowledge, experience and skills available to create a coherent, high-functioning team, then your “perfect” vision may as well not exist. Even in a world of seemingly ever more prevalent algorithms and automated processes, the quality of your collective intellectual capacity, properly resourced and focused, provides the edge that may well separate success from failure; and help take you from vision to result.

The Awbury Team

Is (Re)insurance a Truly Scalable Business…?

Over the long term, the P&C (re)insurance business tends to grow its premiums at a rate roughly equivalent to that of GBP in mature, developed markets. After all, Insureds buy insurance because they believe they need it, not because they want it, even though all parties know that a properly-structured (re)insurance programme, or appropriate covers are essential to protecting businesses, livelihoods and financial wellbeing against exogenous shocks.

Of course, from time-to-time, new risks arise (such as cyberattacks), or the perception of risk changes (such as those related to climate). However, it is hard to create new growth models, even if one can create new delivery mechanisms such as ILS or ILW, or tweak claims definitions through innovations such as parametric covers.

And while market pricing goes in cycles, and new “class of” companies arise, historically there is little evidence that (re)insurance in the aggregate is scalable in the way that other industries can be. In fact, it is becoming ever more bifurcated between specialized, niche businesses and those which truly do have individual scale, and the ability (should they wish to) to defend market positions. As matters stand, many (re)insurance businesses struggle to earn their true cost of capital, or even destroy value, rather than create it.

New entrants benefit from an absence of legacy systems and loss reserves, but they are still, generally, competing based upon the same historic business models, but trying to do so “better” or “differently”. Even the new “AI-supported” Lloyd’s Syndicate, Ki, intends to act as a “follow-the-form” underwriter, and is, therefore, dependent upon the business models of existing brokers and carriers.

All this begs the question of whether or not it is feasible to create a new, scalable paradigm that will somehow fundamentally change the industry. Conceptually, it is hard to think of a completely new, “fundamental” product line that would cause potential Insureds to say: “I never knew I would need/want that”, absent the advent externally of a new product or risk. However, It is certainly possible, as the Awbury Team did in creating its business model, and scaling up a completely new business, to find ways to solve problems that potential clients have struggled with because they believe no effective solutions exists, and so displace existing products, create new demand, stimulate growth, and add value. Yet, in most cases, the industry still follows on from the businesses others create, which then give rise to the need to protect against or manage new risks (cyber, or satellite being two that come to mind), or to penetrate markets where the need for protection is still under-served- the so-called “protection gap”. Essential, yes. Original, no. At Awbury, we aim to be both original and essential.

Therefore, unless it can solve existing issues in new ways, for the foreseeable future, the industry will have to focus on finding an edge in its underwriting processes so that it can consistently achieve Combined Ratios well below 100%, and/or continue to reduce and re-design its cost structures if it is to increase its profitability.

The exponential scaling beloved of the venture capital/”tech” nexus remains a distant dream, even a fantasy, although, as indicated above, one should never ignore the potential for a business model being created that somehow that is so effective that it becomes scalable at the expense of the industry as a whole.

The Awbury Team