Tag Archives: innovation insurance group

Protecting Your Corporate Reputation

A company’s reputation, which is core to its profitability and long-term competitiveness, faces new challenges as information speeds blindly through online media and social networks. Lanny Davis, former assistant to President Clinton on crisis management and principal in Lanny J. Davis & Associates, recently noted that, in the age of the Internet, “you never get a second chance to change a first impression. Once your reputation is smeared and your character unfairly attacked, the eternal misinformation echo chamber of the search engine allows the harm to continue eternally, unless you fight back — early, with all the facts, often yourself — until the truth gets in the way of the search engine lies.”

When a corporate reputation is tarnished, a company can lose its trust factor; investor confidence is weakened; and a company’s share price can be reduced.  In extreme cases, a damaged reputation can lead to a company’s downfall. “Hackgate,” “Rupertgate,” or “Murdochgate” -– names given by the press to the News International phone-hacking scandal – led to the demise of News of the World newspaper.

Let’s make a list of some leading triggers to reputation failure: 

  • unethical behavior such as Sears’ management team’s unrealistic performance quotas for its car repair business, which led to overbilling and created a scandal in the 1990s.
  • financial irregularities, such as those that led to Enron’s bankruptcy.
  • executive misconduct, such as the conviction tied to insider trading that led to Martha Stewart’s resignation.
  • environmental violations, such as Nike’s exploitation of workers in sweatshops, failure to provide work environments that are safe and contact with cotton factories using slave labor—issues that dogged Nike through the 1990s and beyond.
  • safety & health product recalls, such as followed allegations of “unintended acceleration” in Toyota cars.
  • security breaches, such as the recent one at Target in which tens of millions of people had credit-card data stolen.

In other words, much as Murphy’s Law says:  “Anything that can go wrong will go wrong.” 

What should a corporation do to protect its reputation? 

  • Use your CEO: Fred Smith, FedEx’s legendary founder, is a good example.  A good CEO embodies and reiterates a company’s values, code of ethics and vision.  Your CEO regularly communicates honesty and transparency and is trusted with your corporate reputation. 
  • Perform an S.W.O.T. analysis: Identify your company’s strengths, weaknesses, opportunities and threats. 
  • Develop a corporate reputation strategy:  Johnson & Johnson is still reaping reputation benefits more than 30 years after its swift and sweeping recall of Tylenol and institution of tamper-proof packaging after some maniac laced some pills with cyanide and put them in bottles on store shelves, killing seven people.
  • Monitor your reputation online.  Constantly check social media sites and your own website. No company can afford to be reputation-blind, and no suit of armor is impenetrable.
  • Be honest, factual and open with the media. 
  • Create a plan to manage an unexpected crisis.  Execution is the cornerstone. Train everyone on identifying the crisis, what to do and who gets contacted.   Preparation is essential to managing potential and actual crises in a timely fashion.  Communication is no longer one-way; it’s now two-way. 
  • Evaluate the purchase of corporate reputation insurance. For 20 years, the insurance industry has known that how a company manages a reputation crisis will have a dramatic impact on the cost of civil litigation arising out of that crisis.  For this reason, insurance purchased for the risk of shareholder lawsuits, directors and officers insurance, has from time to time included an option to purchase, or included automatically, “crisis management” insurance. This reimburses the company for the cost of crisis management expert fees up to a set amount, usually $50,000 to $200,000.

However, since 2010, there has been an outbreak of “new and improved” reputation insurance policies from name-brand insurance carriers like Zurich (Brand Assurance), AIG (ReputationGuard), Munich Re (Reputation Insurance) and a number of Lloyds syndicates, including a standalone reputation policy produced by Steel City Re.

Some carriers emphasize reimbursement of crisis-management expenses while others are more geared toward reimbursing a company for a loss. Finding the right one, or right combination, can be challenging, but they are worth a look.

Be sure to check out Thought Leader Ty Sagalow's recent appearance on New York News!

New York News

A Case For Cyber Insurance

The Need Is There

There were more than 26 million new strains of malware released into circulation in 2011, the last year with solid data on malware. Such a rate would produce nearly 3,000 new strains of malware an hour! Almost two-thirds of U.S. firms report that they have been the victim of cyber-security incidents or information breaches. The Privacy Rights Clearinghouse reported that since 2005, more than 534 million personal records have been compromised. In 2011, 273 breaches were reported, involving 22 million sensitive personal records.  The Ponemon Group whose Cost of Data Breach Study is widely followed every year indicated a total cost per record of $194 in 2011, an increase of over 40% ($138) compared to the cost in 2005 when the study began.

Other surveys are consistent.  NetDiligence, a company that provides network security services on behalf of insurers, reported in their “2012 Cyber Risk and Privacy Liability” forum the results of their analysis of 153 data or privacy breach claims paid by insurance between 2006 and 2011.  On average, the study said, payouts on claims made in the first five years total $3.7 million per breach.

And, attacks simply don’t target large companies. According to Symantec’s 2010  SMB Protection report (again the last report with good data on SME), small busineses:

  • Sustained an average loss of $188,000 per breach
  • Comprised 73% of total cyber-crime targets/victims
  • Lost confidential data in 42% of all breaches
  • Suffered direct financial losses in 40% of all breaches

Indeed, according to the 2011 Verizon Data Breach Report, in 2010, 57% of all data breaches were at companies with 11 to 100 employees. Interestingly, it was the Report’s opinion that 96% of such breaches could have been prevented with appropriate controls.

Seemingly, not a week goes by without a reference to cyber risk hitting the mainstream press. Recently, a cyber attack was successfully launched against ATMs in 27 countries withdrawing over $40 million in over 30,000 transactions in less than 10 hours.  The New York Times recently reported that universities are facing a rising barrage of cyberattacks, mostly from China.1   And last year saw a number of denial of service attacks against financial institutions brought by sophisticated cyber “criminals” whose attacks were eventually sourced to the nation of Iran in what would truly be considered a Cyber War attack against the U.S. infrastructure.

All This Has Prompted Insurers To Enter The Market (And Make A Nice Profit To Boot)

Cyber-insurance began in earnest in 2000 when American International Group’s AIG eBusiness Risk Solutions unit launched AIG netAdvantage. Starting from scratch, premium jumped to over $100 million by the time the unit was merged into larger subsidiaries of AIG, just four years after its creation. AIG eBusiness was extremely profitable with estimates of loss ratio in the extremely low double digits.

Fast forwarding to today, the cyber-insurance market, according to the 2012 Betterley Report is “in the $1 billion range” in terms of premium (up from $800 million in the 2011 report) with close to 40 insurance carriers providing a standalone insurance policy.  Premium continues to increase with most carriers, accordingly to Betterley, reporting increases from 25% to 100% year over year.  Hard profit figures are difficult to come by; however, strong anecdotal evidence suggests that this line of insurance continues to be highly profitable.  Third party litigation continues to be slow to develop outside the privacy arena and first party claim losses, outside of breach funds, is non-existent.

From an underwriting point of view, some attention should be paid to theft of personal identifiable information (PII), especially with respect to first party costs associated with forensics and customer notification costs.  However, there are established methods to manage this risk successfully for the underwriter.  Indeed, in a widely followed report, Verizon reports that 90% of all breaches can be prevented with proper risk management guidelines.   Of course, like any other portfolio of business, care must be taken with respect to avoidance of catastrophic exposure, adverse selection and moral hazard.  There are underwriting guidelines and processes that can be developed to manage these exposures.

Yet The Market Still Has Plenty Of Room To Grow

Despite the increased attention to cyber incidents, most reports indicate only a minority of companies currently purchase cyber-insurance.  According to the “Chubb 2012 Public Company Risk Survey: Cyber,” 65% of public companies surveyed do not purchase cyber insurance, yet 63% of decision-makers are concerned about cyber risk. In a recent Zurich survey of 152 organizations, only 19% of those surveyed have bought cyber insurance despite the fact that 76% of companies surveyed expressed concern about their information security and privacy. A risk area with a high level of concern but little purchase of insurance? That’s an insurance carrier’s dream

It is unclear why there aren’t more buyers, but most of the industry believes it’s a lack of education. For example, previous surveys indicated that over 33% of companies incorrectly believe that cyber is covered under their general corporate liability.

Regardless of the reason, with respect to foreign corporations whose securities are traded on U.S. exchanges, a recent “Guidance” report2 published by the U.S. Securities and Exchange Commission on October 13, 2011 is likely to increase sales.  The report begins simply enough:

For a number of years, registrants (companies who register their securities with the SEC) have migrated toward increasing dependence on digital technologies to conduct their operations. As this dependence has increased, the risks to registrants associated with cybersecurity has also increased … As a result, we determined that it would be beneficial to provide guidance that assists registrants in assessing what, if any, disclosures should be provided about cybersecurity matters in light of each registrant’s specific facts and circumstances.

The “guidance” report goes on to specify five “suggested” disclosures that may be “appropriate” to companies trading with securities registered with the SEC.  The fifth suggestion is the one that caught the eye of the insurance industry.  It reads simply:

Description of relevant insurance coverage.

This is the first time that I am aware that the SEC included insurance in one of their guidance reports.  The SEC tends to start investigations 18-24 months after issuing a guidance report. It is difficult to imagine how a general counsel would be able to meet this disclosure without an investigation, at least, of specific cyber insurance.  This is especially true given that over the course of the last few years, general liability underwriters have continued to tighten up any language in a general liability policy to a point where an insured would be foolish to even think the policy applies to cyber risks.3

Thus, it is then perhaps not surprising that the Betterley 2012 market report stated “we think this (cyber) market has nowhere to go but up.”  Although, they quickly qualified,  “as long as carriers can still write at a profit.”

And With A Private-Public Partnership There Is Even More Potential

Unlike many other countries, 80% or more of the critical infrastructure of the United States is in private hands.  As we have seen in the last year, cyber attacks are increasingly being brought by companies associated with hostile nation states.  Cyber-terrorism – even cyber-war – is close at hand and, in some minds, is already here.  The insurance industry can and should play a vital role in providing private sector incentives to foster increased network security in the critical infrastructure.  However, the insurance industry cannot do this alone.  The answer lies in a private-public partnership between the insurance industry and the federal government.  Productive discussions are already underway between the Department of Homeland Security and the insurance industry with specific proposals to safeguard and enhance our country’s security being reviewed.

For more details on the need for this public-private partnerships, and what is going on to bring it about, stayed turned for our next article.

1 Universities Face a Rising Barrage of Cyberattacks

2 Cybersecurity

3 While from time to time, this is tested by insureds (see Sony vs. Zurich), almost all commentators have admitted that the “die is cast.”