Hi, this is Subarna Goswami, Associate Editor with Information Security Media Group. We will be talking about cyber insurance and it's a pleasure to be speaking with Bish Maheshwari, Executive Vice President at Marsh India. Welcome. Thank you.
So Bhish, what is that one common mistake that you see organizations making when they adopt cyber insurance policies? So Aparna, let me give you some background on cyber insurance. Cyber insurance is something which is at a very nascent stage in India. I would say it's hardly three to four years old in India while in North America and other European Union countries it's been almost two decades where this policy is in place.
But in India it's relatively new. So the issues which we have faced, clients and other inshorts being facing is that one they're not able to decide on the limits, negative limits of continent capital which they need to buy. So a lot of times when we meet the COs, when we meet CROs at these organizations, their biggest challenge is how do we arrive at a limit of insurance? To buy insurance is basically a continent capital which you buy now that to arrive at the right kind of limit is very important because if there is a loss tomorrow and we have seen in these large breaches, be it Equifax Beat, Marriott beach, north side Road very recently, the losses can be millions of dollars, hundreds of millions of dollars.
So to decide on the right limit is very important and I think this is a very big challenge when it comes to insurance specifically with Indian buyers because of the lack of, lack of data so they're not able to decide on the limits. The other big challenge we have seen with most of the Indian policies is that the Indian insurers have not been able to issue policy with the ecosystem in place. So when you talk about cyber insurance more than an insurance claim it also brings along with us an ecosystem, a service ecosystem. Say there is a beach tomorrow who is going to do the forensics, who's going to do the notifications or IT audit or you know, any other kind of a job PR related to your job.
So all policies are issued outside of India comes with a panel which is inbuilt. Whereas in India right now that's missing from insurers end and our clients are living with that. So these are the two big challenges which I feel right now the Indian companies are making and it's still early days in cyber insurance. I'm sure going forward we'll have some more new things coming up.
There'll be models to decide on the limits There'll be these panels which will be taught under the policy. So going forward, I think these things will change. So, Vishal, as I understand, cyber insurance requires a different kind of underwriting. So what is the challenge that you're seeing when it comes to underwriting under the cyber insurance?
So your life cyber insurance is slightly different from the more traditional insurances like the property and casualty. It requires an insurer, a client, to give out a lot of data related to their cybersecurity. So basically what an insurer or an underwriter is looking at is the information security policy of the firm, the BCP plans which they have. And these documents become the basis of their entire it.
Now, we have seen in most of the cases, either the smaller or the midsize firms do not have these policies in place or they are still in the draft stage, they have not been formalized. And in some cases the larger organization do not want to share these policies, citing various reasons like confidentiality and other things. So this becomes a big challenge for an insurer to underwrite the policy in the absence of these infosecond BCP plans. The other challenges for an underwriter is all through rate risk because, you know, insurance is based solely on the actual data which is available now cyber incidents which are happening in most cases, they're not reported, they're not being reported.
So there's not a lot of data which is available. And then it becomes difficult for an insurer to accurately read the risk which is possible for the other lines of business because there's a lot of data which is available. So tomorrow, when you want to underwrite a property insurance policy, you know that how many earthquakes have happened, how many, how many lives have you lost? What is the total loss because of hurricane or earthquake, which is not true for a cyber incident because the data is not available.
So these are the couple of big challenges which I feel and underwriter faces when it comes to cyber insurance. So I said earlier that cyber insurance is fairly new in India. So when it comes to, you know, a company adopting cyber insurance, what are some of the things that they should keep in mind so that they are fully insured? So very important things which a client has to keep in mind is each client is different.
So you can't compare a financial institution or a bank to a manufacturing, manufacturing client because their cyber exposures are different. While there will be common things like data liability, business interruption, but the proportion of these exposures differ for each industry segments. So you can't have one approach for all kind of industries. So Very important aspect for client to look out for is list down their risk exposures, list down their cyber exposures and then pick up a policy which will suits their requirements.
Cyber insurance is new in India. Good thing is the policy is customizable, it's not straight jacketed. You can pick up certain losses, you can pick up certain titles which you can cover it. It's completely customizable policy.
So in short when he's aware about exposure then he can pick up those losses and cover them under the policy. So that's very important to know right from the start to know what the cyber exposure is and accordingly decide on cover. Second important thing for a client to know or for insured to know is the right kind of partners they're choosing when it comes to cyber insurance. They should go, they should choose the right insurance intermediary broker as well as insurance carrier, the insurer itself because it's not everybody's to get a cyber insurance policy placed.
It's important that a cyber insurance carrier which you're placing a policy through has a, has an experience in handling these kind of policies because once there is a claim it is very important that the carrier comes back and responds in a particular way. So this is something which a client should definitely be wary of but kind of policy they're picking up or kind of product they're picking up which partner they choose it. Thanks a lot. We will listen to Vishwaneshwari for Ice and G Nisha.
This is for Nagas1.