Coordination of cybersecurity risk management in the UK insurance sector

The paper “Coordination of Cybersecurity Risk Management in the UK Insurance Sector” (Geneva Papers on Risk and Insurance, April 2023) evaluates the effectiveness of these efforts by providing a multi-method study of the incidence, nature, and evolution of the cost of data breaches, the investment in computer systems and software intangible assets at risk of cyber-attack, and a content analysis of annual reports of both UK regulators and a sample of UK insurers. The findings suggest that while both the total costs of data breaches and the size of investment in computer systems and software intangibles at risk of cyber-attack have gradually increased over time, the degree of engagement with cyber as a reporting issue by both cyber insurers and financial regulators has not. It is concluded that while these efforts have been apparently successful in avoiding a large scale systemic cyber-attack on the UK insurance industry, there are significant gaps and overlaps in the system of cyber regulatory oversight.