Going Lo-Fi At Sea May Mitigate Cyberrisk

Cyberthreats have become seaborne in recent years, and preventative measures are on the radars of governments and the shipping industry.

GPS and other electronic systems have proven to help ensure safe and accurate navigation, but they have also put digital bullseyes on ship decks. These technology upgrades have unwittingly exposed ships to cyberrisk because their signals are weak enough for remote perpetrators to jam.

When ships and crew members rely solely on GPS systems, they can be at the mercy of a cyberhacker seeking to provide wrong positions (or “spoof”), endanger the crew and their cargo, or hold the crew, cargo or sensitive information for ransom.

These risks are exacerbated by the fact that ships typically do not have automatic backup systems, and younger crew members are increasingly reliant upon the newer electronic navigation tools.

Allianz’s Safety and Shipping Review 2017 highlighted the growing threat of cybercrime in the sector, and noted the increasing level of activity in the last five years. For example, World Fuel Services fell victim to an online bunkering scam in 2014 when it agreed to participate in a tender for a large amount of fuel from what it believed to be the United States Defense Logistics Agency. Cybercriminals collected $18 million from that successful impersonation. In 2016, hundreds of South Korean vessels had to return to their ports after North Korea allegedly jammed their GPS signals.

The report noted that most maritime cyberattacks have been aimed at breaching corporate security, rather than taking control of vessels, but warned that such attacks could occur.

Captain Rahul Khanna, head of marine risk consulting at Allianz Global Corporate & Specialty, noted in the report that more, larger-scale attacks are imminent if the risks are not appropriately addressed. “We can’t put IT security on the backburner,” Khanna said. “Just imagine if hackers were able to take control of a large container ship on a strategically-important route. They could block transits for a long period of time, causing significant economic damage.”

The report also stressed that “crew education and identifying measures to back up and restore systems should be implemented” to reduce cyberrisk.

Looking Back For a Signal Forward
Some companies and governments have heeded the warnings and are identifying these indicators of attack. Preventative measures may lie in a maritime tool that had taken a backseat to the prevalence of GPS—a backup radio technology called Enhanced Long-Range Navigation (eLoran), which was developed in the United States in the mid-1990s. It has continental reach, emits strong signals via a low-frequency and relies on land-based transmitters that reveal a limited number of fixed positions. These once-limiting traits could be the automatic backup systems ships need in the event of jamming or spoofing.

On July 20, 2017, when the Department of Homeland Security Authorization Act (H.R. 2825) passed the floor of the U.S. House of Representatives, eLoran’s importance was stressed. The act includes a section titled “Backup Global Positioning System,” which features provisions for the U.S. Secretary of Transportation to initiate an eLoran system. H.R. 2825 proposes that eLoran be made available as a “reliable…positioning, navigation and timing system,” with the purpose of providing “a complement to, and backup for the Global Positioning System to ensure availability of uncorrupted and nondegraded positioning, navigation and timing signals for military and civilian users.”

Reuters this week reported that South Korea’s Ministry of Oceans and Fisheries is looking to establish the technology in a test form by 2019.

Time will tell if eLoran is the most practical and cost-efficient method to mitigate cyberthreats at sea. It seems if companies want to mitigate maritime cyberrisk now, the first steps would be to look to the technology of the past and turn on the radio.

Marsh Tracks Top Captive Trends

The number of captive insurers continues to increase globally, from 5,000 in 2006 to more than 7,000 in 2016. Once formed primarily by large companies, the captive market has opened up to mid-size and small businesses. The industry is also seeing a trend in companies forming more than one captive, using them for cyber, political risk and other exposures, according to a recent Marsh report, Captives at the Core: The Foundation of a Risk Financing Strategy.

Organizations are seeing disruptions in a number of areas and are relying more on their existing captives, Marsh said. Because of their flexibility, captives are also being used to respond to market cycles and organizational changes such as mergers and acquisitions.

While North America and Europe still dominate in numbers of captives, other regions have shown more interest in the past three years. In Latin America, captive formation increased 11% in 2016, the study found.

Within the United States, there is more competition among domiciles and some of the newer domiciles are experiencing growth. The top-growing U.S. domiciles in 2016 were Texas, Connecticut, Nevada, New Jersey, Tennessee, and New York. Domiciles outside the U.S. seeing the most growth include Sweden, Guernsey, Singapore, Malta, and the Cayman Islands.
As organizations’ exposures increase in number, complexity and severity, shareholder funds generated by captives are becoming more important. According to Marsh:

For many clients, captives are at the core of their risk management strategy, going beyond the financing of traditional property/casualty risks.

Specifically, we are seeing an increase in parent companies using captive shareholder funds to underwrite an influx of new and non-traditional risks, including cyber, supply chain, employee benefits, and terrorism, as well as to develop analytics associated with these risks and fund other risk management initiatives.

Risk management projects funded by captive shareholder funds in 2016 included initiatives to determine capital efficiency and optimal risk retention levels in the form of risk-finance optimization; quantify cyber business-interruption exposures; accelerate the closure of legacy claims; and improve workforce and fleet safety/loss control policies.

For example, Marsh-managed captives used to address cyber liability increased by 19% from 2015 to 2016. Since 2012, in fact, cyber liability programs in captives have skyrocketed 210%.
“We expect to see a continued increase, driven in part by companies that are already strong captive users and by those that may have difficulty insuring their professional liability risks,” Marsh said.

It’s a Great Time to Be a Risk Manager

2017 has so far been a wild ride of change. Companies are navigating through a new U.S. administration, Brexit and cyber risks that are more daunting each day. We are bombarded with uncertainty and unchartered waters. Nevertheless, it’s a great time to be a risk manager.

This kind of disruption is the reason many of us got into the risk and insurance industry.  Addressing disruption is what we do best. According to a recent CNN report, in fact, Risk Management Director is the number-two Best Job in America for 2017. Recognizing the meaningful contributions and rewarding work of a risk manager, the report highlighted the role in “identifying, preventing, and planning for all the risks a company might face, from cybersecurity breaches to a stock market collapse.”

In the midst of a riskier environment, the insurance industry that serves risk managers faces highly competitive market conditions. The result is more choices and better services for the risk management community. Now is the time for the risk manager to take the lead.

As thousands of risk professionals soon head to the RIMS Annual Conference in Philadelphia, it’s a good time to consider the opportunities in this growing profession.

Why the time is right for risk managers:

  1. 2017 brings a new risk profile. Every company, regardless of industry or size, needs to evaluate the new risks from the shift to nationalist policies in the U.S. and abroad. Our new administration’s efforts to increase America’s manufacturing raises a host of new insurance needs—more U.S. production means more U.S. liability. We are also seeing a shift in global supply chain and an increase in the political risks of operating outside our borders. These changes require board-level and C-suite attention. We expect to see risk managers play a more significant role with management in building risk mitigation into their company’s strategic direction.
  2. Rise in specialists. This is your time to be selective about specialists that understand your business and the specific challenges you face. Insurers are differentiating through specialization. Work with an underwriter that knows the risks, regulations, complexities and nuances of your industry. Many industries, such as construction and health care, will experience rapid change this year. Find partners that have been in the same trenches and can help you navigate changes.
  3. Tailored products and solutions. The highly competitive insurance market is also driving product innovation for clients with more tailored solutions. Take the time to learn about less-understood products, such as accounts receivable insurance, which protects companies from non-payment risks and gives them the ability to borrow, receive loans, and as a result, improve their credit quality. In Europe, 70% of companies purchase this coverage, compared to only 8% of U.S. companies. Understand the risks across your supply chain and work with your broker to customize insurance programs and bring innovative solutions.
  4. At the center of technology and innovation. The insurance industry is on the front lines of the cutting-edge technologies: internet of things (IoT), robots and drones. These advances will only grow and thrive with the right risk and insurance programs. For example, the technology surrounding drones or unmanned aerial systems is rapidly evolving. The ability to collect and analyze aerial data has improved efficiencies, enhanced safety and lowered costs within the construction, agriculture, telecommunications, oil & gas and real estate industries. As usage  grows, risk managers will be central to the successful operation of drones by understanding and managing the risks and compliance needs.
  5. Ability to leverage the best in data analytics. Risk managers have the data, tools and skills to anticipate the risks from this tumultuous environment. The insurance industry views these challenges with a different lens, drawing on past catastrophes and predictive analytics to plan for the challenges ahead. Risk professionals who know how to leverage this information can bring a sense of preparedness and control at a time of heightened uncertainty. There is also a role for risk managers to advise senior management on the use of data. But because models are continually amended and updated after losses occur, it is important to avoid an over-dependence on data and false sense of security.
  6. Opportunity to participate in growing your business. Risk managers do not just protect a business, they grow a business. Companies are reevaluating strategies based on new policies. Will they build manufacturing plants? Will they buy a strategic target? Risk professionals have an important role in mergers and acquisitions deals as insurance can be used to help quantify contingent liabilities and allow for accurate pricing models. The most common is representation and warranties insurance, which can help strengthen and facilitate a transaction.
  7. Better risk management services. Insurers realize it is not enough to write a check for a claim. Take advantage of risk mitigation services that are built into your insurance policies. They include education, training, tabletop exercises and risk assessments.
  8. A thriving profession. With more and more universities offering undergraduate risk management majors, we will see a dedicated, high-caliber talent pool focused on careers in risk and insurance. The Spencer Foundation, for example, has completed an eight-month competition between students of 29 universities from around the country, analyzing, developing and presenting the most comprehensive risk management solutions for a case study. The top eight teams will be in Philadelphia to present at RIMS.

The risk and insurance industry is made up of some of the most agile and level-headed professionals. Risk managers have always moved with the changing environment and crisis situations, developing programs to address their entity’s risk profile. Hopefully, we will see more companies include risk management in their strategic planning and leverage the experience and skills of their risk managers.

Accounts Receivables Coverage Helps Fill Supply Chain Gaps

It is standard for companies to insure and protect cash, inventory, property, plants and equipment, and more recently, data. Companies are insuring every step in the supply chain and sales process from concept to delivery. What is often not insured, however, is the last but most important part of a sales transaction—getting paid. You can safely bring your product to market, but if a partner or customer defaults on payment and you have no recourse, you’ve lost your total investment. Your balance sheet takes the hit.

As with most risks, there is insurance for that, too. Accounts receivable insurance protects what is often a company’s most critical asset on the balance sheet. More than just protection from non-payment, accounts receivable insurance puts companies in a stronger position to secure loans with improved credit quality. With accounts receivable Insurance acting as a second source of repayment, a company can assure a lender it will not have covenant issues if there is default by a customer.

Consider these hypothetical scenarios: Bob’s company is based in Canada and he sells components to computer chip manufacturers throughout North America. He buys parts from foreign markets to make his product. The company that supplies Bob with parts has been working with Bob for 30 years. Bob has always paid them for their deliveries. Recently, Bob has struggled to receive payment from his customers in North America due to their decline in computer chip sales.

As a result, Bob is now finding it difficult to pay his supplier on time. The supplier believed Bob had risk management protections in place and would always pay them for their delivery. They never thought Bob would go bankrupt. Fortunately for both Bob and his supplier, he has accounts receivable Insurance. Even though he was exposed to the risk of his customers not paying, his accounts receivable Insurance kicked in as a second source of repayment.

Here is another example regarding the uncertainty of political events in a global economy and how they can impact a company’s balance sheet. A U.S. exporter is selling to Latin America and there are a few countries within the region that are approaching elections. A regime change could mean changes in policies, resulting in the possible cancellation of an import or export license, a moratorium on the payment of any external debts outside the country, or the inability to convert local currency to hard exchangeable currency to make payment. With an accounts receivable program protecting assets, the exporter is able to securely transact with their customers in a foreign market, knowing they’ve mitigated the risk of non-payment due to any potential policy changes or actions.

These examples are not hard to imagine. What is startling to see are estimates that only 8% of U.S. companies have accounts receivable insurance compared with 70% of European companies. In Europe, boards mandate this coverage. This underscores the differences between regional risk perceptions. Perhaps there is a greater recognition of the account receivable risks for companies operating in multiple countries, including developing nations with a high degree of political instability.

With the new U.S. administration, Brexit and other unpredictable market forces in play, it is certain that we will be seeing shifts in the global economy. Undoubtedly, there will be bumps along the supply chain as well, and companies will face challenges, including non-payment.

These bumps are not only for the largest global organizations, however. Middle-market companies will face a new competitive landscape, with a push to focus manufacturing in the U.S., and changes to the flow of their supply chain. This will impact costs and the need for extra working capital. Accounts receivable insurance should be viewed as a tool to bolster the balance sheet to provide the liquidity needed to advance business goals.

Accounts receivable coverage provides a competitive edge by giving suppliers the ability to extend credit to their customers as opposed to requiring payment in advance or on delivery. It can be helpful in lengthening payment terms with customers to match or exceed the competition and allows for these aggressive growth strategies without taking additional balance sheet risk. Accounts receivable insurance also can help a company obtain a higher advance rate with lenders that use accounts receivables as collateral. This will provide increased liquidity without having to increase the asset base and can help in negotiating lower borrowing rates.

Supply chain risks are currently taking center stage as one of our greatest concerns. Don’t forget to protect the ultimate objective in the sales process—collecting payment.