Insuring cyber risks: remember its OT as well as IT

The buzz about the Internet of Things of a few years ago has died down but the cyber world and its things are becoming increasingly interconnected.  When considering insuring cyber risks, insurers must remember it is not only IT (Information Technology) but also OT (Operational Technology) that needs to be evaluated.  Hackers know better than anyone what a nice target things can be, especially with hacking becoming an instrument of war.

Therefore covered cyber risks and silent cyber will cover not only compromised information or data but also the failure of operational assets and equipment resulting in non-damage claims, especially business interruption.

Although IT which is used to operate equipment used to be insulated from outside attack, as soon as it becomes part of the Internet of Things and now that equipment applications can be done remotely, the risks insured increase considerably.  The Internet of Things is also the internet of hackers, cyberterrorists and hacktivists.  Physical damage and non-damage risks can result from the same event and the same wording if not carefully risk-managed.  The overlap between property insurance and cyber and business interruptions insurance is growing fast as the Covid-19 claims have demonstrated.

Every insurer needs to look at their wording to see what they want to insure and what they want to exclude or limit so that nobody is surprised afterwards.  Although increasing claims have led to the introduction of blanket exclusions into policies, these won’t last forever and specific insurance will be required the possible consequences of cyber events. Risks of insured need to be surveyed where the stakes are high and dealt with by careful general wording across the board. Insurance will be sought for both IT and OT consequences of external events such as losses resulting from cyber events affecting utilities, supply chains, and neighbourhoods in the broadest sense.

Remote working is a major part of our world.  Remember that the hackers have been successfully working remotely for years.