Cyber hackers have had decades to perfect their craft, and their attacks show no signs of relenting. An underbelly of over 100 software-esque companies design Hacker-as-a-Service and Ransomware-as-a-Service products to challenge the cyber industry complex. These attacks will only become more sophisticated as these underground organizations build their own large language models and incorporate AI.  

Experts and cybersecurity leaders at Datos Insights Financial Crime and Cybersecurity Forum agreed that malicious actors are becoming more sophisticated. Many are trending towards evasion techniques like living off the land, i.e., using native system administration tools to compromise emails and exploit money. This lack of detectable malware means that cybercriminals can act in their own time, taking CISOs and risk professionals out of the driver’s seat.  

Another factor contributing to attacks like phishing and extortion is a culture of shame that exists in many organizations. Cybersecurity should not be a punitive exercise, and this attitude can disincentivize resources from reporting attacks. What’s more, the responsibility for cyber defense does not rest on employees alone, and the ability for an attack to take down an entire organization with one wrong click is a problematic vulnerability.  

Cyber leaders agreed that “defense in depth,” or multiple layers of security response, is crucial heading into 2024. This approach requires foundational pieces such as backups and multifactor authentication, plus monitoring, plus preparation. The goal, as one panelist pointed out, is to be able to take a punch.  

Yet, as another panelist noted, the approach of defense in depth is also “expense in depth.” Security organizations need to prioritize where to spend and maximize return on investment, given a limited budget. Simplifying operating environments and building a best-of-breed tool stack are sizeable pieces of the puzzle. Resilience will come from broad coverage, not necessarily one tool or a set of tools that can do it all.  

Cyberattacks are becoming easier for malicious actors to execute, which means they are becoming more difficult for cybersecurity teams to get ahead of. To discuss ways to skate ahead of the puck and ready organizations against these threats, feel free to reach out to me at sdalwin@datos-insights.com or Tari Schreider at tschreider@datos-insights.com.

The post Cyberattacks Ahead: A Difficult Prospect appeared first on Datos Insights.

The ease of switching flights suddenly meant nothing, because it turns out there was no flight for me to take at all. And I had to miss out on valuable time with family during one of the only times of year when we can all get together.

It was eventually revealed that the problems underlying this massive systemic collapse were, unsurprisingly, technical. It all came down to an outdated core system supporting complex logistics and a user experience that it was not equipped to handle. Sound familiar?

The need to update core systems is nothing new in insurance. Insurers are keenly aware of this need; according to recent Aite-Novarica research, property/casualty insurers spend roughly half their technology budgets on core—but the preponderance of this is on core maintenance, not core modernization. Nearly 60% of midsize insurers and nearly 70% of large insurers are focused on “run” budgets i.e., not growth or transformation.

Concurrently, property/casualty insurers are also allocating around 20% of their budget to digital. Investments to enhance the digital experience for users are great, even necessary, but they’re limited by the system supporting them. The holiday cancellation crisis at Southwest illustrates this point perfectly: It doesn’t matter how easy a booking experience is if the service you’re expecting won’t be there at the end of the day.

The same is true of the insurance industry: A streamlined experience doesn’t mean much if the underlying system can’t back up the product itself. Automating front-end processes like digital first notice of loss (FNOL) or claims status inquiry are all well and good. But policyholders won’t care about how quickly they could enter FNOL if it still takes weeks or months to settle their claim.

Front-end simplicity requires back-end complexity. Without solid core infrastructure, a nice front end is just a shortcut to a bad customer experience. Core upgrades are complex, and it’s easy to kick the can down the road by wrapping a nice digital experience around an outdated system. However, this approach is at best temporary, and at worst a Band-Aid on a broken arm that prolongs and compounds a lot of pain for later. Digital investments are not a replacement for core upgrades, nor will digital investments pay off if the underlying system does not have the capabilities users need.

People book flights with the intention and trust that they’ll get from one place to another. Insurance similarly exists to fulfill a social promise. Policyholders purchase products to hedge against the risk of actually needing them; if bad things do happen, insurance is supposed to be the safety net that catches the policyholders. Making good on this promise is entirely dependent on underlying systems.

For more information on implementing core systems, see our recent report PAS Lessons Learned: Implementation Best Practices for P/C Insurers.

The post Lessons Learned From Southwest: Digital Isn’t a Replacement for Core appeared first on Datos Insights.

Climate change is emerging as another challenge, particularly for residential and commercial property. According to a recent AM Best Market Segment report, the excess and surplus insurance market grew 25% in 2021, partially due to growth of new and unique exposure risk. Many insurers have shifted homeowners (and even commercial property) policies toward excess and surplus (E&S) coverage as a result.

Partnership Is Imperative

How can insurers calculate emerging risk with limited or no claims and exposure data? This is a question that insurers have brushed up against in the face of other large-scale catastrophes like COVID-19 and cybersecurity, and it’s coming to the fore in the face of climate change.

In all of these cases, the answer will come in the form of analytics. But more importantly, the answer will also require partnership. Some insurers may partner with existing third-party data providers. Insuretech startups are also increasingly focused on climate risk analytics and modeling, and insurers may want to partner with these new and emerging players to onboard their expertise.

The simple reality is that risk and markets are beginning to change at a pace with which the industry is having trouble keeping up. External partnerships may help insurers stay ahead of new and unforeseen risk.

Rethinking the Role of Insurers

A changing risk landscape may also change what insurers bring to the table. As Noldor’s CEO pointed out, the market shift of homeowners from admitted to E&S may leave a vacuum for MGAs (and ultimately carriers); MGAs may be better positioned to navigate individual relationships with policyholders amid an increasingly complex market.

This may be an advantage for insurers who can provide paper and capacity while leaving the relationship management to distribution partners. Yet the emergence of new risk will also prompt insurers to rethink their role in other lines of business. Cyber insurance is one example; the fact that real-time and emerging data and analytics can overcome a lack of historical claims data makes market entry easier for emerging players.

Incumbent insurers may be able to take advantage of the legwork these insuretech companies have done with regards to analytics and risk modeling and act as a fronting partner; in essence, these new players can also be new distribution channels.

Will we see a future in which insurers simply front paper and leave distribution, relationship management, and product development to third parties? It is not likely anytime soon. Insurers will always have knowledge about risk and underwriting that new entrants simply won’t have. Yet insurers may be able to lend this expertise to new industry players and in turn gain access to new distribution channels, market segments, and analytics savvy without having to commit substantial resources of their own.

Enter the Regulators

One eventuality that insurers must anticipate is regulatory intervention, especially if the industry can’t agree on how to price coverage. There is already a precedent for this type of intervention with health insurance and the Affordable Care Act. The potential for regulators to get involved reared its head again with COVID-19 and business interruption coverage: What does business interruption insurance cover, and what is the obligation of insurers to cover losses incurred by the pandemic?

The regulatory future of events or conditions such as the impact of climate change on homeowners is a difficult one to predict; some insurers have limited or stopped writing in high-risk areas altogether, and in some cases coverage has moved to the non-admitted market. Regulators may certainly mandate coverage or provide a federal program in a similar vein to FEMA.

There are three ways to create value in insurance: sell more, manage risk better, and/or cost less to operate. Emerging risks present a challenge to all three. Data, ecosystems, and partnerships present a potential solution. Future-proofing an organization will be dependent on a strong integration strategy and a keen eye on regulatory compliance.

For more information on ecosystems and integration strategy, see our recent report The New Insurance Ecosystem: How Approaches to Core Systems Are Expanding With the Point Solution Ecosystem or reach out to me at sdalwin@datos-insights.com.

The post Bracing for a New Era of Risk appeared first on Datos Insights.

Many of these startup MGAs also have the benefit of looking and feeling like a carrier to the end user without having to hold any of the risk. Some startups, like Next Insurance, eventually raise enough capital to become full carriers.

Some startups, on the other hand, have entered the market as full carriers, positioning themselves as competitors to incumbents. These companies have focused their attention on the customer experience, whether through online distribution (like Lemonade and Hippo), niche products (like Buckle targeting gig economy workers), or usage-based/behavior-based coverage (like Metromile or Root).

The High Cost of Growth

Historically, insuretech startups entering the market as full insurers have focused on raising capital and selling as many policies as possible. This approach is partially due to the niche markets in which they often operate. It is also a factor of the Silicon Valley funding that tends to support these companies: The venture capital experts on Sand Hill Road are not necessarily insurance experts and pursue growth in the form of selling business.

However, longevity as an insurer is often dependent on underwriting profit, and therefore effective underwriting. Selling as many policies as possible can often be at odds with this goal, as it can result in adding policies with bad risk to a book of business.

Interestingly, an S&P Global Market Technology report indicates that insuretech startup carriers are beginning to follow in the footsteps of more established carriers by now focusing on profitability as opposed to pure growth. This is a notable development, especially given the poor performances and high losses of many insuretech carriers that went public.

The Move to Profitability

This shift may be based on a greater understanding of underwriting profitability and the insurance landscape. It may also be due to the fact that many of these insurers operated on losses, hoping to prove a business model. Having done so, they are now positioned to focus on profitability.

In the insurance industry, there are three ways to create value: sell more, cost less to operate, and/or manage risk better. Most startups can keep costs low by using their technical expertise to reduce expenses related to customer acquisition and operations. The instinct to sell as much as possible is a natural next step and is aligned with growth expectations from other industries.

In insurance, though, profitability is not dependent on unchecked sales; it’s dependent on intelligently selling to the right risk profiles and pools of policyholders. Expertise in managing risk better, i.e., underwriting profitability, is what sets insurers up for long-term success. Understandably, selling more based on risk selection is what makes insurance a uniquely difficult industry to break into. Yet more insurers are breaking ground in underwriting profit, signaling potential for longevity.

At its foundation, the insurance industry is based on a simple promise: the promise to be there with financial help when the policyholder needs it. The shift toward profitability is ultimately positive. Many startup carriers entered the industry with the hope of iterating on customer experience and gaining traction among a market segment of digitally savvy consumers.

But this front-end experience alone doesn’t necessarily equate to longevity or profit. The combination of underwriting knowledge and technical expertise is a powerful one that stands to have real impact on the industry long term, and it seems to be the way of the future for startups. To learn more about how startup carriers are operating in today’s environment, please read Aite-Novarica Group’s report Engaging with Startup Insurers or reach out to me at sdalwin@datos-insights.com.

The post Insuretech Profit Depends on Underwriting Profit appeared first on Datos Insights.