Korea Fire Insurance Association survey on cyber risk and insurance

83.6% of experts say corporate cyber insurance coverage falls short of actual risk

89.4% say government and private sector should share burden of major incidents

[Getty Images Bank]
[Getty Images Bank]

Experts say the top priority for growing South Korea's cyber insurance market is building a system to collect and share data on cyber incidents — a collaboration that must involve both the government and the private sector. Without an accumulation of incident and loss data, insurers lack the basis to assess risk and set premiums.

Cyber insurance covers losses businesses sustain from cyber incidents such as hacking, ransomware attacks and personal data breaches. Coverage can extend to damages owed when customer data is leaked, as well as system recovery costs and business interruption losses.

According to the Korea Fire Insurance Association's "Survey Report on Cyber Risk and Insurance," obtained Saturday, respondents ranked "building a system for collecting and sharing cyber incident data" as the top area requiring public-private partnership (PPP). This was followed by developing a standardized cyber risk assessment model, establishing a public reinsurance and risk-sharing framework for large-scale cyber incidents, and drafting standard policy terms with clearly defined coverage.

The data shortage was repeatedly flagged across multiple questions about barriers to market growth. When asked about constraints on the cyber insurance market, respondents cited "insufficient incident and loss data" as the second-biggest obstacle, after low risk awareness among corporate executives. The same factor ranked second in a separate question on the biggest impediment to market development, behind uncertainty over market size and profitability. When asked what supply-side infrastructure South Korea most urgently needs compared with overseas markets, respondents ranked "data and modeling institutions for cyber risk assessment" first.

Many respondents also said the government must step in for large-scale cyber risks that private insurance alone cannot handle. Some 89.4% said risks that private insurers cannot adequately cover — such as state-sponsored cyberattacks or critical infrastructure disruptions — should be shared jointly by the government and the private sector. "Joint risk-sharing between private insurance and the government" was also the most commonly cited approach for handling losses from state-backed attacks. A large majority of respondents agreed that policy support is needed to help small and medium-sized enterprises obtain cyber insurance.

The prevailing view was that domestic companies' cyber insurance coverage falls short of the risks they face. Some 83.6% of respondents said corporate cyber insurance uptake does not match the level of risk companies confront. Another 82.7% said the domestic market relies heavily on legally mandated insurance, suggesting that voluntary demand — companies purchasing coverage because they recognize the need — remains minimal.

"Low cyber risk awareness among executives" was cited as the leading constraint on market growth, by 66.4% of respondents. "Premium costs" came in at 10.0%. Some analysts say the bigger problem is not the cost of coverage but executives' failure to fully grasp cyber risk.

Internal risk management frameworks were also identified as a weakness. Some 82.3% of respondents said cyber risk management at most companies is handled primarily by IT departments. Yet 91.7% said cyber risk should be addressed at the enterprise risk management (ERM) level — encompassing financial losses, legal liability and business interruption — rather than treated solely as a technical security matter for the IT team. The implication: executives need to take direct ownership of cyber risk, not leave it to the technology department.

On the supply side, 94.1% of respondents said standardization of cyber insurance policy terms and risk assessment models is needed, citing unclear coverage scope and the lack of objective risk evaluation criteria as obstacles to market growth. A majority also said cyber insurance should evolve beyond compensating losses after an incident to actively supporting pre-incident risk diagnosis and prevention.

Kwak Hun, head of the Korea Fire Insurance Association's new business strategy team, said cyber insurance and cybersecurity need to be examined together but are currently treated as separate domains, and that integrated risk management linking insurance and security will be essential going forward.

This was the second annual survey of its kind. The Korea Fire Insurance Association polled 110 experts across insurance, reinsurance, cybersecurity, financial institutions and academia from Aug. 3 to Aug. 21. The findings will be shared through the general insurance platform Bridge and a webzine, and the association plans to work with the insurance industry to standardize cyber risk assessment frameworks and explore ways to expand insurance use. The survey will be conducted annually to track market developments and key issues, and to identify areas for policy and regulatory improvement.


won@heraldcorp.com