What has been done so far?
In 2016 WTW conducted a survey, the WTW Transportation Risk Index, which identified cyber and technology risk as one of the key challenges facing the transportation sector. Since 2017, the cyber risk environment of airlines has transformed and as a result, insurance market conditions for airline cyber risks have become more challenging.
In January 2022, WTW took a fresh look at the key cyber risks and insurance challenges facing the commercial airline sector, to better understand the outlook for airline cyber insurance and shape solutions required to support the sector – which continues to be perceived as high risk by the cyber insurance market. This review of the insurance market’s perceptions of airline cyber risk identified some consistent themes.
What are the perceived challenges for airlines?
Leading cyber insurers raised various key challenges including the following:
- Airlines have a heavy reliance on critical IT service providers such as global distribution systems (GDS) providers which creates aggregation of exposure across the airline sector;
- The airline sector is seen as critical infrastructure which makes them a higher target for attack;
- The COVID-19 pandemic has had a significant financial impact on airlines and there are concerns about the lack of funds to invest in IT upgrades and cyber security;
- Airlines rely on the availability of systems and networks. The business interruption impact, in terms of flight disruptions, from a system outage seems to happen very quickly and insurers have little data with which to quantify the exposure;
- The data heavy nature of airlines makes them an attractive target for cyber extortion and breaches often lead to complex cross-jurisdictional issues.
Perception versus reality: Are insurers’ concerns justified?
Reliance on critical IT service providers
It is true that airlines rely on IT service providers to perform day-to-day functions. This ranges from booking systems to IT telecommunication providers. However, the question is whether this reliance on IT service providers is higher than other industry sectors. For example, the retail industry is reliant upon payment processors and the banking industry is reliant upon financial technology (fintech) providers. WTW questions whether airline exposure is justifiably considered higher than those respective industries.
Within a standard cyber policy, by covering an airlines’ business interruption as the result of an outage at an IT service provider, insurers are concerned with the potential for aggregation across their portfolio. In short, should there be a significant outage at a service provider upon whom numerous airlines are reliant, an insurer could be exposed to losses across several, if not all, of their airline insureds. Nonetheless, this applies to all interconnected insureds - not exclusively to airlines.
Critical infrastructure - but supported by cyber security legislation
Airlines are considered critical infrastructure. Due to the essential services they provide and the importance of their continued operations, legislation has been implemented for airlines to establish a baseline level of cyber security requirements for their network and information systems.
This was put into force in the European Economic Area by the Network & Information Systems Directive (NISD), and then implemented via national legislation, including via the Network & Information Systems Regulations (NISR) in the UK. Similar regulations have been adopted or are being adopted in other territories (for example the Singapore Security Act), thus increasing the regulatory requirements for airlines worldwide.
We would challenge the perception that airlines are a greater target than other critical infrastructure. In fact, the increased regulatory environment for airlines will encourage advancement in IT maturity across the sector and therefore airlines should be less vulnerable to attack.
Lack of funds to invest
The COVID-19 pandemic has undeniably affected all organisations in some manner, including airlines but the extent of its impact on IT investment is unknown. However, it is our understanding from speaking to airlines that cyber security budgets were ringfenced during the pandemic and are not sacrificing cyber security spending to invest in other operations. In addition to internal pressures at airlines to enhance IT security, the increased regulatory environment further supports the need to focus on IT and cyber maturity.
Business interruption impact
With the knowledge that airlines are heavily reliant on the availability of systems and networks, cyber insurers perceive that the business interruption impact will not only be immediate but also significant should an airline suffer an interruption to its systems and network. WTW claims data can provide context and clarity to this assumption. An average duration of an airline/aviation cyber event according to WTW data is 10.5 days and the average loss equates to USD 10.6M. (Source: WTW client notifications, between 1 January 2015 to 1 June 2022).
Without the support of data from airlines, insurers will assume a worst-case scenario and here we would encourage airlines to share what data they have, to challenge any misconceptions. This quantification analysis will often not require new resource, but an assessment of the data already held regarding flight groundings arising from traditional non-cyber perils, for example volcanic ash clouds.
Data heavy nature of airlines
Airlines by their nature are data rich organisations. Collecting large volumes of data records annually in the form of passenger data results in airlines being exposed to breaches of personal data which can include credit card information and, in some cases medical information. The airline industry is not alone in being data rich, other industries including hospitality and healthcare providers also collect and store vast quantities of customer data that could make them an attractive target for malicious actors looking to exploit organisations and profit from cyber extortion.
Three key steps for airlines to follow:
