The Expert Podcast

When it comes to hard markets like cyber insurance and other unusual risks many larger firms are looking at captive insurance As a possible solution What is captive insurance and how does it work And I'm going to help your business Let's take a look Specifically we'll look at the example of cyber liability insurance or cyber insurance as a Guinea pig Of putting together a captive insurance coverage policy Captive insurance refers to where a large corporation Kind of forms its own insurer That's licensed it's regulated by the state To cover specific risks for its unique business or hard to place business The insurance company is a separate entity Technically it's arms length from the insured But it's created to cover specific losses Sometimes it's put in place to effectively be like a stop-loss So above a certain amount of a self-insured loss the captive will cover the difference And with cyber the reason this is happening is policy rates are increasing Many standard insurers are struggling to make cyber Policies profitable So you may have insurance companies that offer you coverage And then after some period of time they'll non-renew because they can't make a profit off cyber insurance The terms for cyber policies are also getting worse the risk managers and underwriters in the companies are really putting the clamps down on what is covered on a cyber policy because it's too open-ended Sometimes the insurer will put specific terms on the insured Like you have to have ransomware procedures You have to have two factor authentication Look if you're going to do all those steps in your company to Eliminate the risk Why not self-insure for a certain amount and then place a captive To do a stop loss over and above what you can absorb as a company Remember we're not attorneys we're not giving you legal advice This doesn't apply to every company And make sure you get good Advice from your corporate counsel or maybe your insurance broker Because here's the thing the vulnerability and losses that are a potential from cyber attacks I really have no upside Meaning that there's there's not a ceiling on how much you could lose If your building burns down you know how much it cost to build your building The losses that could occur from a cyber policy are unlimited They could exceed The value of your company If you have costs involved too covered losses to customers to consumers fines penalties criminal fines This could be something where a typical insurance policy with a limit may not be sufficient So a lot of times what a company will do is they'll self-insure for a certain amount they'll use the best practices from their captive to put in place Loss prevention within their company that they would have to do anyways If they bought a regular policy from a standard company And then Use that captive to maybe get coverage from excess and surplus lines Lloyd's coverage some other types of coverages To cover their catastrophic potential losses from a cyber event some CFOs are seeing their cyber policies go up 20 30% a year Which means it's going to double in three four years So why not put together a package either for your own company or maybe create a little co-op with some colleagues or similar industries That can custom tailor coverage with some excess and surplus lines or like I said Lloyds coverages that will take care of What happens over and above and beyond what you can self-insure for or play some tertiary Or mezzanine coverages in the middle Of yourself insurance and your Your stop-loss cause that's going to be a big deal obviously to do a captive formation You have to follow the same regulations in your state Make sure you have proper financial disclosures You have an arm's length from the The parent company so to speak and have the right types of Due diligence so that neither entity has risk that's off the balance sheet Right So if the parent company has risked for the captive that has to be on their balance sheet if the captive Is relying on the parent company that can create You know a a conflict of interest So get good legal advice for that
But whether it's a captive or even a co-op with a couple other similar companies with similar risks it's a way to avoid the wild west of cyber insurance That's happening right now in the marketplace for some companies this cyber Chaos Is the reason for creating a captive in the past there was enough standard lines For traditional business or commercial insurance In the markets existed for these commercial lines but you didn't need to form a captive unless you had some very unusual risk or very unusual business
This is the motivating factor for a lot of companies that never even considered Doing captive in the past and this is what's kind of triggering that to happen And it's not just because it's a hard market it's because the coverages Might be harder in the future even if you could squeak out a policy today or next year Or two three years from now it might go away or the coverages might not be sufficient You may want to start putting together a longer-term plan today So you're not going to be non-renewed and lose coverage in a couple of years Don't use a captive though To try to evade some of the requirements That you'd have for cyber liability use the hard requirements That a traditional commercial market Would put on your company as guidelines If you're going to create a captive Because those are the best practices Anyways you probably want to exceed The best practices If you're going to form a captive Because if you don't you're going to be at more risk and that with a captive you have more to lose as well So if you're a company that's in the many hundreds of millions or billions that's may be worthwhile If not you may go with a standard commercial market For cyber liability If you have questions you can reach us at our website and let us know what you think in the comments Is this something that applies to you You've thought about it Or if you have an existing captive for other coverages are you looking to add cyber to it because you already have it in place