Insurers eye ‘crossover’ from cyber events to management liability covers

Insurers and their clients must pay more attention to potential crossover between traditional management liability insurance coverages and cyber insurance, according to a panel of experts speaking here at this week’s NetDiligence Cyber Liability Forum.

This convergence of coverages requires policyholders to sit down with brokers and affirm the type of events they could reasonably see and the appropriate insurance to address all needs.

For insurers, having one cyber event that hits multiple lines brings up risk aggregation concerns.

According to John Graham of Zurich, the “obvious” one is D&O, which could respond to any number of cyber events where directors and officers might be held liable for their organizations’ actions or inactions.

Any carrier that offers many lines of business is evaluating the issue, according to Tim Francis of Travelers. Cyber policies would respond to a data breach, but the same event might result in shareholder derivative claims against directors and officers.

“It might be the same loss, but it’s not necessarily what you would call the same claim,” said Francis. He also cited the potential for an impact on employment practices liability, is employee information is lost, noting, “There is at least a potential, theoretical, hypothetical for crossover.”

Greg Vernaci of AIG commented that AIG eyes aggregation exposure on “every single risk.” He said it has not been an issue to date, but that he could envision errors and omissions (E&O) crossover, particularly in the healthcare and managed care industry.

Florence Levy of JLT remarked that she “resisted” the term “cyber” for a long time, feeling it didn’t accurately capture the risks to businesses and could lead to confusion to the extent that coverage for a cyber event could exist under other policies.

“It’s very, very important to see where some of these coverages might dovetail,” she told the audience. Levy added that she spends significant time discussing the differences between a cyber “trigger” and the “next consequence” of that event and ensuring that clients have the right coverage for the risk they actually face.