Buyers of commercial insurance, who have seen relatively stable to slightly increasing rates over the past three years, reported paying 1% less to cover their total cost of risk than in 2013, according to the 2015 RIMS Benchmark Survey.

“The 2014 survey results reflect the overall stability of the U.S. property/casualty market. One notable driver is the increasing role of alternative capital in assisting reinsurers to deal with economic uncertainties. A related factor is the rising importance of predictive models among insurers, not only in the area of property, but also for cyber and casualty,” Jim Blinn, executive vice president and global product manager at Advisen, said in a statement.

Looking ahead to the second half of 2015, Blinn said commercial property/casualty insurers are beginning to see a softening market. “We are looking at a period of rate decreases in insurance premiums owing to rising competition in the market and more than enough available capacity.”

The survey, which encompasses industry data for more than 52,000 insurance programs from over 1,400 organizations, found that risk managers and underwriters have identified climate change as one of this decade’s defining issues. “It continues to be a cause of concern among companies and organizations as evidence linking it to flood and other natural disasters continue to mount. Already, regulators such as the U.S. Environmental Protection Agency (EPA) are sounding the alarm for the high economic cost of climate change,” according to the study.

Key findings in 2015 include:

  • Slight decrease in TCOR following three years of increases.
  • Average TCOR fell 1% from $10.90 per $1,000 of revenue in 2013 to $10.80 in 2014.
  • Management liability, workers compensation, liability, and property costs declined.
  • Risk management administration costs dropped 5% as costs for both outside services and risk management departments declined.


By and large, organizations tend to invest in preventative cybersecurity measures and they also concentrate their resources on detecting and stopping cyberattacks, rather than on painstaking “who did it?” investigations. They want to close the gap, manage the public opinion fallout, learn from the episode and move on.

From an enterprise perspective, this makes sense, as resources dealing with cybersecurity are usually overstretched and the organization does not stand to gain much from determining, with a certain degree of certainty, who was behind a cyberattack. The incentive equation, of course, is different if the target of the attack is a government or a large organization that is part of a country’s critical national infrastructure.

Attack attribution has traditionally been approached from the perspective of enabling the target or victim entity to pursue the attacker either for damages in a court of law; or from a national, military or intelligence “strike back” perspective.

While dishing out some form of retribution has always been instinctual, however, only governments and very large corporations have historically had the technical toolbox, the economical means and the long-term view to pursue a cyber retribution strategy.

But should commercial and non-commercial organizations also care about cyberattack attribution? Yes, within measure.

The first question ought to be: why? What does the target organization stand to gain from investing in cyber-attack attribution? The answer is that, the better it understands the attackers tools and techniques, the more likely the organization is to direct its limited resources to the right areas of defense.

As we know, each attacker or attacker group has certain preferred tooling and attacking methods. Also, they have their own motivation, speed, operational capability and discipline.

Assuming that an organization can safely concentrate only on patching, employee awareness programs, scanning, pen testing, log monitoring and other traditional defensive security measures, would be a mistake. These measures are, of course, necessary but they can no longer be the entire apparatus of cyber defense. Organizations need to invest a certain proportion of their resources in understanding their cyber adversaries, and their motivations, modus-operandi, credibility and capabilities, in order to better tailor their defensive resources.

What would be the “adequate” amount of time and effort for an organization to spend on seeking to attribute a cyberattack, successful or not, to a malicious actor or group? The effort should be proportionate with what is at risk and what resources the company has, either in house or via its suppliers and industry. Knowing at least how some of their enemies attack, however, can help companies to better leverage their resources when defending.


The reinsurance industry has recently seen a rise in mergers and acquisitions among some of its biggest players, such as Axis Capital Holdings Ltd. and PartnerRe Ltd. Faced with challenges like soft market conditions and impending regulation around the globe, many companies have turned to consolidation. Case in point: In 2014, acquirers spent $17 billion on property and casualty, multi-line insurance and reinsurance deals – the most since 2011, according to data compiled by Bloomberg.

Claude Lefebrvre, chief underwriting officer at Hamilton RE, described M&A as part of a cycle that tends to take place during the soft market. Last year, about 390 insurance transactions were announced for a combined value of almost $50 billion, making it the busiest year for deals since 2008. This begs the question: Is bigger actually better?

At a recent roundtable in Bermuda, a group of executives talked about the pros and cons surrounding the current spate of mergers and acquisitions in the reinsurance and insurance markets. The discussion noted that M&A may not be as beneficial to the reinsurance market as previously conceived, and looked specifically at the long-term benefits (or lack thereof), the potential for culture clashes among merged organizations and the impact of investors.

Here is what some of the conversation entailed:

Long-term benefits of M&A

With a rise in the number of consolidations, many smaller reinsurance companies are under pressure to make a deal sooner rather than later. But does this ultimately increase shareholder value, especially in cases of like-for-like companies?

Brenton Slade, chief operating officer at Horseshoe Group, believes there would be far less M&A activity if management teams took the time to look at the rationale behind the proposed deal and how it would benefit shareholder value over the long term. With this strategy, he believes we would see more money being returned to investors or being deployed into new product lines as opposed to just expanding equity bases.

As stated by Robert Johnson, president at Aon Benfield Bermuda, being a company with $10 billion of capital does not necessarily provide access to much more business than being a $5 billion size company. Potential challenges, such as ensuring companies have the right synergies and the loss of good employees, may outweigh the benefits of a merger.

Culture Clashes

A major issue seen with the rise of mergers is combining two company cultures and their legacy systems into one cohesive unit. A recent study from Xuber showed that cultural integration and incorporation of multiple systems was the biggest challenge faced by companies following M&A.

Issues such as determining what team members stay on, what the company will be called and where the company will be based are huge decisions and can cause a great deal of tension. The integration of existing data systems, legacy systems, contracts and processes is just as challenging.

Companies need to take culture into consideration when acquiring another organization and determining how they will mitigate issues that arise. This can also be used as an opportunity to refresh old legacy systems and integrate new data storage systems to replace outdated technologies.

Additionally, it poses an opportunity for smaller companies to have an advantage when it comes to the M&A process, as they have fewer systems in place and can adjust easier. Smaller companies are also at an advantage when larger companies merge, as they can capitalize on dislocated teams and bring in new lines of business.

Investor Impact

Some believe that investors, and their desire to increase their capital base, are driving much of the current M&A activity. Previously, investors wanted to manage performance; this has changed dramatically as investors have become less focused on performance or meeting certain return or risk policies. Now investors are less involved and often do not understand the reinsurance industry. They are simply looking to increase the size of companies and in turn their capital base, without looking at the long-term impact of consolidation or the benefits of having two smaller companies.

Will Things Keep Getting Bigger?

Bloomberg predicts that we will continue to see a rise in M&A activity as the demand for bigger and more diversified portfolios increases and companies see it as the only option to remain competitive. Smaller companies will likely feel the pressure to become involved and see it as the only way of securing any kind of substantial future.

On the other hand, this may present an opportunity for smaller companies to shine. As their larger competitors struggle with the challenges brought on by the M&A process and are not able to focus on day to day activities, smaller companies can produce higher quality work and scoop up some of the larger company’s lost talent.

The debate will likely continue as to whether the pros outweigh the cons, or vice versa, in the recent spate of M&A activity in reinsurance and insurance. It is yet to be seen that we can truly prove bigger is better. What do you think?


Background check

Is your company guarding against the threat of insider attack? If you responded with, “well, we do background checks when they are hired,” that’s a good start, but what about risk assessment during the course of an individual’s employment?

The 2015 Insider Threat Spotlight Report from Infosec Buddy found that less than half of companies have the proper tools to fight insider threats. And, according to 62% of security professionals, that threat has increased in the past year. The average company faces four insider attacks every year, with an estimated price tag of $500,000 each, in addition to the astronomical impact a breach can have on an organization’s reputation.

So where is the disconnect? It starts with how we assess individual risk.

The limitations of the current employee screening model

The majority of companies conduct a one-time background check on new employees before they are hired. This is a necessary part of the risk assessment process, and the majority of background screening companies are great at what they do, but this model is built on a flawed assumption: that employee risk remains constant over time.

While an employee may not have posed a risk when hired, that can change quickly. Stressful life events such as a bankruptcy, a DUI, a divorce or a negative performance review can change an individual’s risk profile in an instant. It is also important to note that traditional background checks typically focus exclusively on criminal records, failing to analyze other important information sources like human resource documents, financial records, and social media activities.

And it’s not just employees. Insider threats can come in the form of third-party contractors, vendors, suppliers, and partners – in other words, any parties with the ability to access sensitive corporate information. A recent Accenture survey found that 76% of companies believe supply chain risk management is “very important.” The reality is that people are dynamic, and so are their motivations, which is why companies need comprehensive tools for managing personnel risk as it evolves over time.

The future of background checks: continuous identity screening

Getting proactive about managing the risks of insider threats starts with finding ways to continuously monitor personnel risk after they are brought into the organization. Advances in software offer one way to approach this challenge. Programs now exist that allow companies to actively monitor changes in personnel risk as it evolves, throughout an individual’s tenure with the company.

Continuous identity screening software automatically gathers and analyzes risk data from all relevant information sources, such as public records and HR documents, and proactively alerts risk and security managers to the most pressing threats. This allows risk managers to be continuously updated in real time, instead of traditional methods of pre-hire or periodic screening, which can uncover risk after it’s too late.

Take the example of a city bus driver who has received a recent DUI charge. Many employers would not be notified of that until a regularly-scheduled periodic background screening, if at all. Most employers rely on their employees to self-report incidents, but that does not always happen for obvious reasons. By implementing continuous screening, companies can immediately learn about that bus driver’s DUI charge, which prompts an investigation that could lead to further action.

Today’s continuous screening tools can also be customized by industry. For instance, the financial services industry may attribute more risk to an employee filing for bankruptcy than a transportation company would, whereas the healthcare industry may view odd activity on the network as a greater indicator of potential IP theft. Every industry has its own unique challenges and obstacles in meeting the mandates and regulations necessary. Tailoring the screening process accordingly can help proactively address those issues.

What does this mean for you?

By bringing together identity data from external sources like criminal and financial records with internal sources like network activity and personnel reviews, organizations can reduce the risk of insider threats. It also allows organizations to maintain compliance through a legally defensible audit trail designed to meet critical regulations such as FCRA, FTC, and EEOC.