Our clients, an insurer and an international accreditation company, asked us to carry out independent research exploring the nature of cyber-risk and the role of cyber insurance and reinsurance as a risk mitigation tool, with a focus on cyber-catastrophe events, ,i.e. events that could seriously undermine a national economy. Our clients wanted us to take an idea of ours forward - how cyber-catastrophe reinsurance might help mitigate cyber-risk - and establish some evidence of the appetite for such reinsurance, while examining how government might best provide support for the establishment of an efficient, largely free-market solution.

Started in May 2015, the resulting report entitled "Promoting UK Cyber Prosperity: Public-Private Cyber-Catastrophe Reinsurance" was released in July 2015 (press release).

We explored the nature of cyber-risk and the role of cyber insurance and reinsurance as a risk mitigation tool with a focus on cyber-catastrophe events that is cyber events that could seriously affect the economy. As well as copious desk research, we engaged directly with insurance and reinsurance professionals; existing public-private reinsurance schemes; cyber security experts; ICT companies; financial services firms; law and accountancy firms; and regulators and government departments through over 80 semi-structured interviews, a round-table, and a webinar.

The report explores how a public-private cyber-catastrophe reinsurance scheme could help secure ICT-based prosperity in the UK by helping insurers insure themselves to insure others. The scheme would provide cover to a group of insurers above a catastrophic loss threshold, in effect a pool funded by the insurance industry. The UK government’s role would be one of promotion and (possibly) a last resort insurer only in the event that industry retentions and the scheme’s reserves have been exhausted. In all likelihood, the UK government would be a last resort insurer anyway during a cyber-catastrophe, but would benefit by having already promoted risk reduction and mitigation, as well as having accrued some financial reserves.

In 2019, the UK government passed legislation permitting the national terrorism reinsurer, Pool Re, to extend its cover to business interruption and cyber.