As Bermuda’s reinsurance professionals gather with global colleagues in Monte Carlo for Rendez-Vous de Septembre, the world’s largest privately held independent insurance broker has published a report finding that critical infrastructure clauses in cyber insurance are inconsistent across the market.

Lockton Re’s report, When the Lights Go Out: Cyber’s Infrastructure Blind Spot, discusses the evolution of the clauses, their application and how they are interpreted across the cyber insurance and reinsurance market.

Lockton Re’s position is that critical infrastructure clauses in cyber insurance should clearly say the same thing across the market.

The report focuses on the review’s findings that current wordings included significant cross-market inconsistencies and shortcomings.

It said the ambiguity creates uncertainty for insurers, reinsurers, brokers and policyholders.

Further it said: “Scenario modelling demonstrates a potential 20 per cent relative decrease, or 15-point loss ratio reduction in industry loss ratios at the one-in-50 return period.

“The clauses have been neglected in the wake of the industry discussion of cyber war clauses.

“Governments are increasingly treating data centres as critical infrastructure. That presents a new challenge for insurance products, which must be clear about the coverage they maintain as the definition widens.”

The exposure spans utilities, telecommunications and financial infrastructure and are beyond the scope of the current market, the report said.

Oliver Brew, head of Cyber Centre of Excellence at Lockton Re and coauthor of the report, said: “The clauses have been neglected in the wake of the industry discussion of cyber war clauses. Clarity of intent for critical infrastructure is key to understanding where the boundary lies of what is insurable.”

A critical infrastructure clause defines which infrastructure sectors fall outside, or are limited within, the scope of a cyber insurance or reinsurance policy. It is the wording that sets the boundary between the cyber-risk the market is prepared to carry and the systemic exposure it is not.

Definitions of critical infrastructure have been updated over time, often in response to specific cyberattacks, but the language inevitably falls behind the technology it describes.

Laura Betts, cyber account executive at Lockton International and coauthor of the report, said: “We engaged with participants across the market including insurers, reinsurers, brokers, and industry associations to provide insights.

“With the rapid advancement of new technology, insurance policy language has failed to keep up with the changes in the ways technology is used.”

Mr Brew added: “There is an urgency to ensure that the intent of these clauses is aligned with the reality of how they can be interpreted. It is incumbent on the whole industry to improve the clarity of what is intended in order to enhance the industry’s reputation.”

Lockton Re wants the market to decide on what is critical infrastructure, review the existing clause language, ensure it is consistent and matches the legislative intent, and ensure the language is fit for purpose.

Ed Le Flufy, global head of Cyber at Lockton Re, concluded: “As new technologies proliferate and aggregation potential grows, the definition of what constitutes critical infrastructure and clarifying the coverage afforded by the market is essential to sustainable growth.”