Silent (or non-affirmative) cyber coverage and the systemic risk it poses is a serious concern for the insurance industry, leading to scrutiny from the Prudential Regulation Authority (PRA) and prescriptive intervention by Lloyd’s of London (Lloyd’s) over recent years.

This Practice Note considers silent cyber in professional indemnity insurance (PII), the regulators’ concerns, what the industry has done about it and what the future holds, in particular for professional indemnity (PI) insurers and policyholders.

Cyber risks encapsulate any risk associated with financial loss, disruption or damage to the reputation of an organisation arising from the failure or unauthorised or erroneous use of its IT systems. These risks can arise from both malicious acts (eg cyber-attacks) and non-malicious acts (eg infrastructure downtime and accidental loss of data).

Cyber risks are growing in number and public awareness of them is increasing. This comes from the ever-increasing reliance on IT systems by organisations of all types (businesses, defence, education, healthcare, charities etc) and the increased frequency of cyber-attacks