I have been fortunate enough to have the opportunity to spend October on the Big Island of Hawai’i at a friend’s home while we button up the 6.2 release of Precinct. My wife and I were able to visit the Crater Overlook at Mount Kīlauea this week. Mount Kīlauea is the home of the Hawai’ian goddess Pele who controls the flow of lava (among other things.) Peering over the crater to see new earth being born under a canopy of ancient stars was breath taking and quite frankly an existential experience.
No Such Thing as Lava Insurance
In talking to locals, we were surprised to learn how inexpensive real estate is on the Big Island. When we inquired why that was true, we learned that there is no such thing as lava insurance. Driving the 2 hours from Waimea to the peak of Mount Kīlauea, we observed large lava flows dotted with huts and temporary housing that have accepted that another destructive lava flow is imminent.
We also couldn’t help but marvel at the kīpuka that have survived the last flow or two. These dazzling forests in the middle of fresh igneous rock illustrate the possibility of hope while being surrounded by a reminder of the likelihood of catastrophe.
Not All Risk is the Same
The graphic below from USGS shows the danger of lava damage across the island.
It is reasonable to understand that there is an inversely proportional relationship between lava risk and property value. You can purchase very inexpensive land in high risk zones while paying a higher rate in less risky zones.
Even in the low hazard zones of Kohala (where we are staying) it is still virtually impossible to secure a homeowners policy that covers damage from a lava flow. Here are some of the considerations that lead to that:
- Likelihood of claim is high. Houses are built on active volcanos.
- There are no certain methods of mitigation. Nothing is known that can effectively stop a flow.
- Loss amounts are very high. Your home is either a kipuka or fresh rock; no claim or catastrophic loss.
- Lava behavior cannot be deterred. We do not have the ability to scare or change the behavior of lava flows.
Cyber Insurance Parallels
Ahead of jumping on the 777 across the Pacific, I was spending a good amount of time speaking with individuals on different sides of cyber insurance. The discussions included a growing strategy by insurers to not issue policies at all. As I was staring into Kīlauea I could not help but ponder the shared similarities between cyber insurance and lava flow coverage.
Likelihood
Over the last 10 year, we have seen an explosion in cyberbreach headlines. As we observe the FBI cybercrime loss numbers below, we see that likelihood of cybercrime is growing at rate faster than a lava flow.
Ineffective Mitigation
The graphic below shows extreme, growing investment in cybersecurity.
The following graphic shows venture capital (VC) investments in cybersecurity innovation.
In comparing the investments made in mitigating cybercrime to the growth in cyber losses, it is easy to understand why many insurers have concluded that effective mitigation is less possible in cybersecurity than it is in lava protection. While we can argue that there is more we can do moving forward and that not every organization has the same risk as others, it is irrefutable that what we are collectively doing is not delivering effective mitigation. That is very bad news if one is shopping for a cybersecurity policy because it matters much less how strong one organization is, it matters what is the risk of the insured group.
Cyber Loss Amounts
As the FBI IC3 graphic above show, the losses being reported are skyrocketing. To an insurer, this massive claim payouts make the prospect of issuing policies prohibitive.
Deterrence – The Untapped Hope
In a recent Dark Reading article, Handcuffs over AI, I posit that making deterrence the primary outcome of cybersecurity operations (SECOPS) is our only sustainable path to curbing cybercrime. While Pele and her lava will not be influenced by the whim of man, mortal criminals facing certain arrest and imprisonment will change their behavior.
Mountain Top Prophecy
As cybersecurity insurers continue to research how to service policies, coordination with law enforcement will become the lynchpin in delivering affordable policies. Insurers will increasingly encourage (or enforce) sharing of information with law enforcement so global deterrence increases. If an insurer is going to pay a claim because of a criminals’ action, it will be increasingly important that the individual criminal is prosecuted so subsequent claims are not paid. As criminals see more of their peers going to prison, they will be less likely to launch a campaign.
When private corporations, law enforcement, State Department and insurers align to deliver deterrence, the focused power of legal, diplomatic and economic pressures create a painful and inescapable global dragnet.
While the world will never be completely safe from cybercrime, focusing on increased deterrence will deliver favorable outcomes that include cyber insurance that is more available and less costly than lava insurance in Hawai’i.
