The new rules of specialist underwriting in a digital risk economy

Cyber risk used to be easier to put in its own box. Today, a single incident can reach suppliers, customers, operations and the boardroom. That is creating a different underwriting conversation.

Insurtech Amsterdam sat down with Sytse Huidekoper and Shalinie Baidjnath of Markel Nederland to discuss what they are seeing in the market and how specialist insurance is responding in a digital-risk economy.

1. Cyber insurance has become more accessible in parts of the market, but the risk environment is not necessarily getting easier. What are the developments you are watching most closely when underwriting cyber risks today?

The developments we watch most closely are third-party dependency, rapidly exploited vulnerabilities and increasingly sophisticated social engineering. Cyber risk is no longer only a matter of an organisation's own network. A security breach at a cloud service provider, software vendor or managed service provider can affect many insureds simultaneously, making supply-chain and accumulation exposure a key underwriting concern.

Ransomware also continues to combine operational disruption, data theft and extortion, while Al makes phishing and impersonation more convincing and less expensive to produce. Deepfakes and AI-generated communications can make it increasingly difficult for employees to distinguish legitimate instructions from fraudulent ones. Strong access controls, patching, tested backups and incident-response planning therefore remain essential.

2. Many businesses still see cyber insurance as something that responds after an incident. How is the role of the cyber insurer changing from claims payer to prevention and resilience partner?

Cyber insurance is evolving from a product that primarily responds after a loss into a service supporting the entire risk lifecycle. Before an incident, insurers can help clients identify weaknesses and improve preparedness.

During an incident, fast access to forensic, legal, communications and recovery specialists can materially limit the impact. Our incident response services bring together forensic expertise with legal and regulatory support, crisis coordination, communications and liability management. After an incident, lessons learned and claims experience can be used to improve controls, contractual arrangements and future resilience.

The insurer does not replace the client's responsibility for cybersecurity and cannot prevent every incident. Its value lies in combining underwriting and claims experience with a coordinated response that improves resilience and helps prevent an incident from becoming a business-threatening event.

3. For SMEs and mid-market companies, what are the most common misconceptions about cyber risk that can lead to underinsurance or poor risk preparation?

A persistent misconception among SMEs is that they are too small to attract cybercriminals. In the Netherlands, many cyber attacks target smaller companies. In reality, attackers often target accessible systems, vulnerable software, weak authentication or employees who can be manipulated, regardless of company size. Smaller businesses may be particularly exposed because they have limited financial and IT resources, and depend heavily on a small number of systems, people or suppliers. A cyber incident could therefore have a disproportionate, financial impact on an SME, potentially even resulting in a bankruptcy.

Underinsurance often arises because businesses focus only on restoring data or hardware. They may underestimate business interruption, forensic and legal costs, third-party liability and regulatory consequences. Companies should understand which third party providers support their critical activities, what security requirements apply and how operations will continue if a provider becomes unavailable. Limits, sublimits and waiting periods should therefore be tested against realistic loss scenarios rather than selected primarily on price.

4. Technology, AI and external data are increasingly used in underwriting. Where do these tools genuinely improve cyber risk selection, and where is human underwriting judgement still essential?

Technology and AI can help our underwriters process large volumes of complex and technical information more efficiently. This allows underwriters to spend less time on repetitive administration and more time on analysis, product development and relationships with brokers and clients.

Although technology and AI become more important in underwriting, human judgement remains essential to determine what terms, conditions, capacity and pricing are proportionate. Technology should inform underwriting decisions, not make them independently.

6. How are cyber, professional indemnity, D&O and crime exposures converging for fintech and insurtech businesses, and what does that mean for how insurance solutions should be designed?

Regulators are placing greater emphasis on operational resilience, consumer protection, transparency and financial crime controls. Risk can therefore no longer be assessed in separate silos, but must be understood across the entire organisation and its digital ecosystem. In this perspective, cyber, fraud, professional liability and regulatory risks become increasingly interconnected. A single incident could trigger cyber, professional indemnity, and reputational consequences at the same time.

This development also creates a need for insurance solutions that reflect the interaction between different exposures. Markel has recently launched its Investment Management Insurance proposition in the Netherlands, combining Directors & Officers Liability, Professional Indemnity, Crime and Cyber for asset managers, private equity and venture capital firms, and real estate investment funds. This integrated approach recognizes that one event may affect several areas of exposure and aims to provide a more coherent insurance solution.

7. For boards and senior management, cyber and digital dependency are increasingly governance issues. What should directors and officers be asking themselves before an incident or regulatory investigation occurs?

Directors should be able to demonstrate active oversight of cyber and digital dependency, rather than solely relying on assurances from the IT department. They should understand their critical systems and third-party dependencies, approve the organisation's risk appetite and ensure that incident-response, business-continuity and recovery plans are tested.

DORA makes ICT risk and operational resilience a board responsibility for financial institutions, while the Dutch Cyberbeveiligingswet imposes comparable governance and training duties on organisations within its scope. After an incident, regulators and other stakeholders will examine not only which measures were implemented, but also how the board exercised oversight and responded to known vulnerabilities or dependencies.

8. Looking ahead, how can brokers, clients, insurers and insurtechs work together to make specialist insurance faster and more relevant without losing underwriting discipline?

One of the opportunities for the insurance market is the improvement of the quality and flow of information exchanged between all parties. Clients should be helped to provide relevant risk information in a clear and structured format. Brokers can add value by understanding the client's business model and presenting the risk in context, while insurers must be transparent about the information they genuinely need to make a decision.

Long questionnaires do not automatically produce better underwriting. Standard risks and routine information can be processed more efficiently, while complex risks require earlier dialogue and specialist judgement, for example with a discussion involving the CISO, Risk Engineer and Cyber Underwriter. Technology adds the most value when it strengthens collaboration and allows underwriters to focus on the issues that can materially change the underwriting decision.