This paper examines the evolution, application, and interpretation of critical infrastructure clauses within the cyber insurance and reinsurance market. We have modelled different impacts of various interpretations of infrastructure clauses, finding that, on an industry loss ratio basis, there is a 15 percentage point delta at the 1:50 return period between the broadest infrastructure exclusions and if no relevant exclusions were in place. We encourage the market to:
- Evaluate and review what constitutes critical infrastructure
- Consider whether the language and the intent are sufficiently aligned
- Look at developing technology-agnostic infrastructure clauses to mitigate the rapid changes in technology impacting the clause
By deconstructing the complexities of existing definitions and highlighting areas of inconsistency, we would expect to see the emergence of a more consistent market understanding. Achieving greater clarity is increasingly urgent, as critical infrastructure considerations continue to shape the future boundaries of cyber risk insurability.
Read the report here (opens a new window).